Hashing Files

A hash is like a digital fingerprint. When you run a hash on a folder (or the files inside it), you generate a long, unique string of letters and numbers. If even one single bit changes, one pixel in an image, one character in a document, one byte in a video, the hash will change completely.

That matters because digital evidence is easily altered. Files can change accidentally (by opening and re-saving), by corruption, by syncing software, by malware, or by intentional tampering. Without a hash, you cannot prove the file you’re presenting today is the same file you originally collected.

Hashing protects you in three major ways:

First, it protects integrity. You can show that the evidence has not been altered since acquisition.

Second, it protects credibility. If someone challenges your findings, you can demonstrate mathematically that the data is unchanged. That makes your work defensible in court, in client disputes, or in public investigations.

Third, it protects against accusations. In adversarial environments, which OSINT and investigations often are, someone may claim you fabricated, edited, or manipulated evidence. A properly documented hash quickly shuts down that argument.

Think of it this way:

If you don’t hash your evidence, you’re basically saying, “Trust me, I didn’t change anything.”

If you do hash your evidence, you’re saying, “You don’t have to trust me. Verify it yourself.”

That shift, from trust to verification, is what makes professional investigative work defensible.

Below are ways your own machine can hash evidence in folders. These methods will hash the content of the folders individually and provide a log. They will not hash the interior of subfolders, and every folder must be hashed individually.