2.1 Why Authenticity Matters
Unlike physical documents where tampering may leave visible traces, digital evidence can be modified without any visible indication. A screenshot can be edited, an email header forged, a WhatsApp backup manipulated. Authenticity challenges are therefore critical in digital evidence cases.
Authenticity attacks focus on establishing that the digital evidence may not be what it appears to be - that it could have been:
- Fabricated: Created entirely for litigation purposes
- Manipulated: Modified to add, remove, or alter content
- Corrupted: Degraded or changed through improper handling
- Misattributed: Not created by or from the alleged source
The burden of proving authenticity lies on the party tendering the evidence. Your role is to create reasonable doubt about whether the evidence is genuine and unaltered.
2.2 Hash Value Verification
Understanding Hash Functions
A hash function takes any input and produces a fixed-length string (the hash value). The key properties:
- Deterministic: Same input always produces same hash
- Sensitive: Any change in input produces completely different hash
- One-way: Cannot derive input from hash
- Unique: Different inputs produce different hashes (collision-resistant)
Cross-Examination on Hash Values
A: We did forensic imaging.
Q: Show me where the original hash at seizure is documented?
A: (Reviews report) The acquisition hash is here.
Q: Is this the hash of the forensic image, or of the original device before imaging?
A: Of the image.
Q: So we have no hash from the moment of seizure to compare against?
A: The imaging was done immediately.
Q: "Immediately" means what - minutes, hours, days after seizure?
A: I would need to check the logs.
Without matching hash values from seizure to analysis, there is no cryptographic proof that the data was not modified. Any gap in hash documentation is an authenticity vulnerability.
2.3 Metadata Analysis
Metadata is data about data - embedded information about when a file was created, modified, by whom, and on what device. Metadata can expose fabrication or manipulation that content examination cannot.
Key Metadata Types
| Metadata Type | Information | Cross-Exam Value |
|---|---|---|
| File System | Created, modified, accessed dates | Expose backdating, anachronistic files |
| Document | Author, company, edit time, revisions | Different author, excessive edits |
| Email Headers | Server routing, timestamps, IP addresses | Spoofing, routing anomalies |
| Image EXIF | Camera, GPS, date, settings | Location mismatch, device inconsistency |
A: Yes, that is the date on the document.
Q: Have you examined the file metadata?
A: The document content is clear.
Q: The metadata shows "Created: 28th March 2023" - 13 days after the supposed date?
A: Perhaps it was recreated.
Q: So this is not the original document created on 15th March?
2.4 Chain of Custody Attacks
Digital Chain Requirements
Digital evidence requires stricter chain of custody because modifications are invisible. Key requirements:
- Seizure documentation: Device description, condition, immediate isolation
- Write-blocking: Devices must be imaged using write-blockers
- Faraday isolation: Mobile devices must be shielded from wireless access
- Access logs: Every access must be documented
- Hash verification: Hash comparison at each transfer point
Request full chain of custody documentation before trial. Examine seizure memos, Malkhana registers, FSL transfer documents, and access logs. Any gap or inconsistency is a cross-examination opportunity.
2.5 Establishing Tampering Possibility
You do not need to prove tampering occurred - only that it could have occurred given the gaps in procedure. Questions to establish tampering possibility:
- Was the device password-protected when seized? Who unlocked it?
- Was write-blocking hardware used during imaging?
- Were mobile devices kept in Faraday bags?
- Who had access to the evidence between seizure and analysis?
- Are there gaps in the access logs?
- Were any analysis tools used that could modify data?
"It is not for the accused to prove the evidence was tampered with. It is for the prosecution to prove it was not." Digital Evidence Handbook
Key Takeaways
- Hash values are digital fingerprints - no matching hashes means compromised integrity
- Metadata reveals creation dates, authors, and edit history - often exposes fabrication
- Chain of custody for digital evidence requires write-blocking, Faraday bags, access logs
- Establish possibility of tampering - you need not prove it actually occurred
- Request full documentation before trial to identify gaps