Labs / Hashes and verification
The evidence image that changed
Three evidence images were hashed when they were acquired. Re-hash them before analysis, find the one that no longer matches, and name who handled it last.
Briefing
Case 2291 has three images in the evidence store. Each was hashed at acquisition and the hash was written on the custody form.
Before anyone analyses an image, its hash is checked against the form. If it does not match, the image cannot be relied on until someone explains the difference.
forensic-01 · Hashes and verification
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.