How to hash and verify an evidence file

A hash is a fingerprint for a file. You run the file through a hash function and get a short, fixed-length string. Run the same file through again, on any computer, and you get the same string. Change anything in the file, even one pixel of one frame, and the string comes out completely different.

That makes hashing the simplest way to show a file hasn’t changed. Record the hash when you collect the evidence. Later, anyone (you, the attorney, the other side’s expert) can recompute it. If the values match, it’s the same file.

This guide shows how to do that with tools already on your computer, which algorithm to use, and what a hash does and doesn’t prove. It’s written for PIs, and it works just as well for attorneys and paralegals checking files they’ve received.

Use SHA-256

SHA-256 is part of the Secure Hash Standard published by NIST (FIPS 180-4). It’s widely supported, and no practical way is known to create two different files with the same SHA-256 hash.

Avoid the older algorithms for new work:

• MD5 has been broken for collisions for years. CERT’s vulnerability note on MD5 advises that it should be considered cryptographically broken and unsuitable for further use.
• SHA-1 was publicly broken in 2017, when researchers from CWI Amsterdam and Google produced two different PDF files with the same SHA-1 hash (the “SHAttered” attack).

If an older case recorded MD5 or SHA-1 values, don’t discard them. Add a SHA-256 value alongside when you next handle the files.

How to hash a file on Windows

PowerShell (Windows 10 and 11). Get-FileHash uses SHA-256 by default:

Get-FileHash "C:\Evidence\2026-031\V-001.mp4"

The output shows the algorithm, the hash and the path. To hash every file in a folder and save the results to a spreadsheet-friendly file:

Get-ChildItem "C:\Evidence\2026-031" -File |
  Get-FileHash -Algorithm SHA256 |
  Export-Csv "C:\Evidence\2026-031\hashes.csv" -NoTypeInformation

To check a file against a hash you were given:

(Get-FileHash "V-001.mp4").Hash -eq "PASTE-THE-EXPECTED-HASH-HERE"

True means it matches. PowerShell’s -eq ignores upper and lower case, which is what you want, because the same hash may be written either way.

Command Prompt. certutil is built into Windows:

certutil -hashfile "C:\Evidence\2026-031\V-001.mp4" SHA256

How to hash a file on macOS

Open Terminal and use shasum with -a 256:

shasum -a 256 ~/Evidence/2026-031/V-001.mp4

To hash every file in a folder into a list, then verify the whole list later:

cd ~/Evidence/2026-031
shasum -a 256 *.mp4 *.jpg > hashes.txt
shasum -a 256 -c hashes.txt

The check prints OK for each file that matches and FAILED for any that doesn’t.

How to hash a file on Linux

sha256sum is part of GNU coreutils and is on almost every distribution:

sha256sum V-001.mp4
sha256sum *.mp4 *.jpg > hashes.txt
sha256sum -c hashes.txt

When to hash

1. As soon as practical after collection. Copy the originals off the card, hash them, record the values in your evidence log or chain-of-custody record.
2. After every copy. Hash the copy and confirm it matches the original. This catches corrupted transfers as well as tampering.
3. At delivery. Give the client the hash values with the files so they can verify what they received.
4. Before use. Before a deposition, hearing or production, recompute and compare.

For a full offloading routine for surveillance footage, see surveillance video and photo file management.

What changes a hash, and what doesn’t

A hash is calculated from a file’s contents only.

These don’t change the hash: renaming the file, moving it to another folder or drive, or copying it byte for byte. The file name and the filesystem’s “date modified” aren’t part of the contents.

These do: editing, trimming, cropping, rotating, re-encoding, converting format, adding a watermark, or “saving as.” Even opening and re-saving an image without visible changes usually changes it.

Two practical consequences:

• Messaging apps and some cloud services recompress media. A video sent through a messaging app, or a photo uploaded to some social platforms, is often a different file on the other end, with a different hash. If you need to prove integrity, deliver originals through a channel that doesn’t alter files. See how to share files with clients securely.
• Edited versions need their own hashes. If you produce a trimmed clip or a redacted still, it’s a new file. Hash it, label it as a derivative, and record which original it came from.

Why hashing matters in court

Before evidence can be considered, it has to be authenticated: shown to be what it’s claimed to be. For digital files, a hash value is a common, checkable way to show that a file hasn’t changed since it was hashed.

How a file is authenticated in a particular case, and in a particular court, is for the attorney to decide. Hashing doesn’t make evidence admissible on its own terms. What it does is give the attorney a solid, checkable answer to “how do we know this file is unchanged?”

What a hash doesn’t prove

A matching hash shows the file is the same as when it was hashed. It doesn’t show:

• When the file was created. A file could have been altered before you first hashed it. That’s why you hash early and keep a contemporaneous log.
• Who created it. Authorship comes from your testimony, your log and your chain of custody.
• That the content is true. A hash of a doctored screenshot is still a valid hash of a doctored screenshot.

A trusted timestamp can close part of the first gap. Under RFC 3161, a timestamp authority signs a file’s hash together with the current time, giving independent evidence that the file existed in that exact form by that time.

A simple routine

1. Copy originals off the card.
2. Hash them (one command for the whole folder).
3. Save the hash list in the case file and note it in your chain-of-custody record.
4. Verify every copy and backup against the list.
5. Include the hash list with every delivery.

Five minutes per case, and one of the strongest things you can do for your evidence. For the rest of the handling process, see how to preserve digital evidence and the evidence handling checklist.

Spotted an error? Tell us by email and we'll correct it.