Overview#
A digital forensics examiner clones a suspect's hard drive and records the SHA-256 hash of the forensic image. Six months later, at trial, defence counsel asks whether the file presented in court is identical to what was seized. Without cryptographic proof that the hash has not changed at any point in between, the answer is uncomfortable. With the Evidence Integrity Verification module, the answer is definitive: every verification event is recorded, every hash checked against the original, and the full chain of verification is available as a court-ready report at any time.
Integrity verification is not a one-time check at ingestion. Evidence can be accessed, copied, transferred, and processed many times before it reaches court. The module applies continuous monitoring across the evidence lifecycle, alerting immediately if any file's fixity check fails, and maintaining the complete verification history so examiners can demonstrate uninterrupted integrity from collection through presentation. This approach meets the standards required by criminal courts, digital forensics labs, financial regulators, and prosecutorial offices operating under strict admissibility requirements.
Key Features#
- Multi-algorithm cryptographic verification supporting SHA-256, MD5, and SHA-3 for evidence authenticity, with algorithm selection configurable by jurisdiction or case requirement
- Continuous integrity monitoring applying scheduled fixity verification across stored evidence, with immediate alerts on any detected hash mismatch
- Digital signature support for non-repudiation of evidence handling events, linking specific examiners to verification actions
- Real-time on-demand verification with sub-second validation for individual items, suitable for pre-submission checks
- Batch verification for validating entire evidence collections before case preparation milestones or court submission deadlines
- Court-ready integrity reports with complete verification history, hash values, signing identities, and timestamps, formatted for PDF/A-3 archival export
- Digital Notary integration providing cryptographic tamper-evident timestamps on verification records
- Forensic soundness validation meeting legal admissibility standards across Irish courts and international jurisdictions
Use Cases#
- Verifying evidence integrity before court presentation to confirm that files are identical to what was originally collected and sealed
- Continuously monitoring evidence repositories for unauthorised modifications, with immediate quarantine and alert when anomalies are detected
- Generating court-ready integrity verification reports that document the complete fixity history of each evidence item
- Batch-validating evidence collections at key case preparation milestones to confirm all items remain unaltered
Integration#
The Evidence Integrity Verification module connects with evidence management, chain of custody, digital signature infrastructure, and compliance reporting systems.
Open Standards#
- RFC 3161 (Internet X.509 PKI Time-Stamp Protocol): The module's Timestamping Authority client implements RFC 3161 in full, producing ASN.1 DER-encoded timestamp tokens with nonce-protected replay prevention and multi-provider failover, so every verification event carries a cryptographically bound, independently verifiable time proof.
- NIST FIPS 180-4 (Secure Hash Standard): Fixity verification supports SHA-256 and SHA-3 (as well as MD5 for legacy interoperability); SHA-256 is the platform default for all hash columns, signature payloads, and TSA message imprints, in conformance with the FIPS 180-4 approved digest functions.
- RFC 8032 (Edwards-Curve Digital Signature Algorithm, Ed25519): Examiner signing of verification events and chain-of-custody records uses Ed25519 private keys, providing non-repudiation without the performance overhead of RSA while remaining compatible with the RFC 8032 signature scheme.
- W3C Verifiable Credentials Data Model v2.0: Evidence provenance is wrapped as W3C VC DM v2.0 Verifiable Credentials, pairing the SHA-256 file digest with an Ed25519 platform signature so that any relying party can cryptographically verify both the content hash and the issuer without trusting the platform directly.
- ISO 19005 (PDF/A, Document management, Electronic document file format for long-term preservation): Court-ready integrity reports are exported as PDF/A archival documents; the module supports all four conformance levels (PDF/A-1B per ISO 19005-1:2005 through PDF/A-4F per ISO 19005-4:2020) to satisfy the long-term admissibility requirements of different jurisdictions.
- NIST FIPS 140-2 (Security Requirements for Cryptographic Modules), AES-256-GCM: Evidence at rest is encrypted with AES-256-GCM, an authenticated cipher approved under FIPS 140-2, ensuring confidentiality and integrity of stored artefacts throughout the custody lifecycle.
- eIDAS Regulation (EU No 910/2014): The RFC 3161 TSA providers configured by default include eIDAS-qualified timestamp authorities, meaning timestamp tokens satisfy the EU electronic-signature regulation's requirements for qualified electronic time stamps in cross-border legal proceedings.
Last Reviewed: 2026-02-23 Last Updated: 2026-04-14