Analyst guide · Crime & Investigation
Direct answer: Matching authenticated digests support a comparison of recorded bytes. They do not fill every gap in possession, identify each custodian or establish that all handling was documented.
A practical verification workflow
- Record the exhibit identifier, seal, acquisition method and handover events. Keep the physical original distinct from a read-only image or working copy.
- Normalize all custody timestamps and calculate the uncovered interval. A signed release and signed receipt can leave an intermediate period undocumented.
- Connect access logs to the actual item before treating them as custody evidence. A locker card opening does not show which object was placed inside.
- State integrity findings and custody limitations separately. An intact seal or equal digest should not be inflated into a conclusion about every unobserved event.
A separate worked illustration
A fictional exhibit is released at 11:00 UTC and received at 12:10. A storage-room card event at 11:25 has no item scan. It may be a relevant lead, but it does not establish custody of that exhibit. Equal image digests before and after preserve a narrower, useful integrity finding.
The common reasoning error
Avoid the opposite mistake too: a documentation gap does not automatically prove tampering. Report the gap and the positive integrity evidence together.
Keep an auditable analyst note
Record the question, source identifier, original observation, conversion or calculation, and the narrow conclusion it supports. Separate a confirmed fact from an inference and from information that is still unknown. Keep the original timestamp or unit alongside any normalized value so another reader can reproduce the reasoning.
Practise with the related case
Operation Custody Stitch: Locate the Unverified Handover applies this skill in a fictional evidence packet with five graded objectives. This guide explains the method, not the hidden answer key. Case evidence and entities are invented; the separate illustration above is not a substitute for reading the dossier. Sign-in is required to use the case terminal.
Questions readers ask
Does a missing signature prove alteration?
No. It identifies a documentation problem unless other evidence establishes alteration.
Are a device and its forensic image interchangeable records?
No. Track each object and the relationship between them explicitly.
Reporting context and further reading
INTERPOL cybercrime operation report · 2026-10-22. This primary-source reporting provides recent topic context only. It is not evidence that the invented case happened, and its publication date may differ from the incident dates described.
Explore the Case Vault · Browse Intel Drops