Digital Forensics Learning Center

Start here

New to digital evidence? These five plain-English guides cover the core ideas in order.

Solutions & pillars

One free tool, many jobs. Explore the solution most relevant to your work.

By topic

Free checklists

Print-ready, no sign-up. Use them to keep collection and validation defensible.

Glossary

Plain-English definitions of the terms used across this Learning Center.

Hash

A fixed-length cryptographic fingerprint of a file's contents. Change one byte and the hash changes completely, so a matching value proves the file is unaltered.

SHA-256

A modern, collision-resistant hash algorithm producing a 256-bit value, widely accepted in forensics, courts and audits.

Checksum

A short value computed from a file to detect changes. Cryptographic hashes are strong checksums suitable for evidence.

Chain of custody

A documented record of who handled an item of evidence, when, and what was done to it — an unbroken trail from collection to court.

Tamper-evidence

A property by which any alteration becomes detectable. Hashing makes digital files tamper-evident because edits break the recorded hash.

Integrity certificate

A one-page record of per-file hashes and an overall verification result, optionally signed and timestamped, proving files are unchanged.

BSA Section 63

The provision of India's Bharatiya Sakshya Adhiniyam, 2023 governing admissibility of electronic records and their accompanying certificate.

IEA Section 65B

The provision of India's Indian Evidence Act, 1872 requiring a certificate for electronic records to be admissible — the predecessor to BSA Section 63.

RFC-3161 timestamp

A trusted timestamp issued by a Time Stamping Authority that cryptographically proves data existed at a specific point in time.

PAdES

PDF Advanced Electronic Signatures — a standard for long-term, legally recognised digital signatures embedded in PDFs.

BagIt

A file-packaging format that stores evidence files with a manifest of their hashes, so a batch can be re-validated as one bundle.

Hash collision

When two different inputs produce the same hash. Broken algorithms like MD5 and SHA-1 allow collisions, which is why modern hashes are used for evidence.

Write blocker

A hardware or software device that reads a storage medium while preventing any write, preserving the original during acquisition.

e-discovery

The process of identifying, collecting and producing electronically stored information for legal proceedings in a defensible, documented manner.