Which element best describes hash verification in evidence handling for digital forensics?

• A. It records only the final hash after analysis.
• B. It is optional for admissibility.
• C. It uses tamper-evident seals only.
• D. It includes documentation of handling, tamper-evident packaging, time-stamped logs, and hash verifications.

Answer: (D)

Hash verification in digital forensics is about proving that evidence remains unchanged as it moves through handling, storage, and analysis. The strongest description isn’t just computing a hash; it’s embedding those checks within a full, traceable process. You generate a hash when the evidence is collected and re-check it at every transfer or access to confirm integrity. But to make that guarantee trustworthy in practice, you couple the checks with thorough documentation of how the evidence was handled, tamper-evident packaging to deter and reveal any tampering, and time-stamped logs that record who accessed or moved the evidence and when. This combination creates a transparent chain of custody and verifiable integrity, which is essential for trust and admissibility in court.