Authenticity, integrity and traceability
Learn what hashes establish and why source, context and procedure still matter.
Three concepts to examine together
- Integrity: whether a file still matches the preserved version.
- Authenticity: whether the material is what it is represented to be, considering its source and the collection procedure.
- Traceability: the documented sequence of collection, handling, storage and transfer.
What a hash establishes
A cryptographic hash is calculated from the bytes of a file. Changing the file normally changes the resulting value. Matching hashes support a finding that the compared bytes match the version associated with the recorded value.
VERATIU documentation describes SHA-256, SHA-512 and SHA3-512 for file comparison. Use the values actually present in your delivered package.
What to inspect in the delivery
Review the report, file inventory, manifest and event records. Where a delivered package includes a Merkle root or a signed manifest, use the corresponding verification information.
A report may describe preservation formats, digital signatures or timestamps. Treat PDF/A, PAdES, timestamp and signature status as properties to verify in the delivered artifact, rather than assuming they apply to every file.
Check the material after delivery
- Download the complete package and keep an unchanged original copy.
- Find the record identifier and file hashes in the delivery.
- Use the VERATIU validator and compare a locally calculated file hash with the recorded value.
- Review the result together with the report, source, dates and context.
What technical verification does not establish
A matching file hash does not by itself identify the person behind an account, establish that a statement is true, establish lawful access, or decide legal admissibility.