Forensic Hash Chain

Compare stored and recomputed forensic evidence hashes.

Description

Forensic hash comparison checks supplied stored and recomputed digest strings.

Forensic hash comparison checks supplied stored and recomputed digest strings. It does not generate or cryptographically link hashes.^[1]

Compare stored and recomputed forensic evidence hashes.

When to use Forensic Hash Chain

Use this tool to compare stored and recomputed forensic evidence hashes.

Prepare the documented facts, aligned totals or expected/observed evidence labels requested. Choose applicable requirements and thresholds separately before interpreting a planning screen.

How to use Forensic Hash Chain and understand its results

Prepare the documented facts, aligned totals or expected/observed evidence labels requested. Choose applicable requirements and thresholds separately before interpreting a planning screen.
Enter storedHashes, recomputedHashes using the field table and calculation rules, then run the tool.
Read mismatchIndexes, verifiedCount, mismatchCount, chainIntact. The explanation below defines the units, signs, ordering and any flags or placeholder values.
If the tool reports an input issue, correct the values and run it again. Apply the stated assumptions when interpreting a successfully returned result.

Input field	Meaning	Value type; see rules below	Requirement
storedHashes	Stored evidence hashes	list of string	Required
recomputedHashes	Recomputed evidence hashes	list of string	Required

Enter aligned nonempty string lists; compare exact case-sensitive strings. Return zero-based mismatch indices, counts and all-equal chainIntact flag.

mismatch when stored[i]≠recomputed[i]

Units, indexing, boundary conditions and exceptional cases are defined in the calculation rules above.

Output field	Meaning	Value type
mismatchIndexes	Zero-based hash mismatch indexes	list of number
verifiedCount	Verified hash count	integer; minimum: 0
mismatchCount	Hash mismatch count	integer; minimum: 0
chainIntact	All hashes match	boolean

json

{
  "input": {
    "storedHashes": [
      "a1",
      "b2",
      "c3"
    ],
    "recomputedHashes": [
      "a1",
      "b2",
      "x9"
    ]
  },
  "output": {
    "mismatchIndexes": [
      2
    ],
    "verifiedCount": 2,
    "mismatchCount": 1,
    "chainIntact": false
  }
}

Limitations and assumptions

No hashing, algorithm validation, evidence acquisition or chain-of-custody verification is performed; blank equal strings can pass.

Numeric inputs, where present, must be finite. Follow the calculation-specific rules for overflow, underflow and exceptional cases. Lists are limited to 100,000 entries; the rules above may require smaller limits. Missing required fields, extra fields, wrong value types and violations of the calculation rules are input errors. A successfully returned false flag is an evaluated outcome; its meaning is explained above.

Alternative or Complementary methods

Use Record Count Reconciliation: Reconcile source and target record counts within a caller-supplied tolerance. For a complementary task, use Duplicate Vendor Payment: Find duplicate vendor-payment candidates by normalized name and amount tolerance.

References

Forensic Hash Chain — tool.io

Similar or alternative tools

Record Count Reconciliation
Reconcile source and target record counts within a caller-supplied tolerance.
Duplicate Vendor Payment
Find duplicate vendor-payment candidates by normalized name and amount tolerance.