evidence_verify_integrity
Recompute hashes of all evidence files and compare them to baseline values recorded at case opening, verifying no modifications occurred during investigation.
Instructions
Recompute every evidence hash and compare to the value recorded at case_open. Run at the end of an investigation to prove the originals were never modified.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |