Digital forensics: prove that your evidence copy changed.

Preserve before you experiment

Incident response contains a tension: stopping harm can change evidence. For a real incident, document your actions and seek qualified help where the stakes require it. This lesson uses two dummy files in a new folder. Never practise on the only copy of potentially important evidence.

Create the lab

Make a folder named hash-lab. Inside it, create original-demo.txt containing a short fictional note, then copy it to copy-demo.txt. Put this Python 3 script in the same folder as compare_demo.py.

from pathlib import Path
import hashlib

def digest(path):
    result = hashlib.sha256()
    with path.open("rb") as stream:
        for block in iter(lambda: stream.read(65536), b""):
            result.update(block)
    return result.hexdigest()

original = Path("original-demo.txt")
copy = Path("copy-demo.txt")
if not original.is_file() or not copy.is_file():
    raise SystemExit("Create both dummy files first.")
print("Original:", digest(original))
print("Copy:    ", digest(copy))
print("Matching content:", digest(original) == digest(copy))

Run python3 compare_demo.py. Identical copies should report Matching content: True. Edit only copy-demo.txt, save it and run again. The digest changes and the comparison becomes False. The script reads these two files; it does not alter them.

Explain the limits on camera

A matching digest strongly supports that the file contents match. It does not prove who created a file, that it is harmless, when it was collected or that the original was authentic. A digest does not preserve a complete filesystem, RAM, metadata or deleted data.

For serious evidence, maintain an acquisition record, timestamps, custody history, verified tools and the relevant professional procedures. Work on a verified copy and protect the original.

If this is a real incident

Record visible symptoms and the time. Isolate an affected device when appropriate without improvising destructive clean-up. Use a known-clean device for account recovery. Preserve relevant logs and contact your response team or trusted professional before wiping a device that may contain important evidence.

References: NIST guide to integrating forensic techniques, SP 800-86 and Python hashlib documentation. Source checked: 22 October 2026.