What is the purpose of a hash chain in evidentiary analysis, and how is it computed across a dataset?

• A. To encrypt data across the dataset
• B. To prove integrity across related evidence; compute hash for each item and maintain a chain or manifest; compare to known good values.
• C. Hash chains replace digital signatures
• D. A single hash of the entire dataset

Answer: (B)

Hash chains in evidentiary analysis are all about proving integrity across related pieces of evidence. The idea is to create a record that ties each item to a verifiable value so you can detect any tampering or alteration.

In practice you compute a cryptographic hash for each item in the dataset (for example, a file, a disk image, or an artifact). You then store those hashes in a chain or manifest that associates each hash with the item’s identifier and relevant metadata. This chain allows you to re-check the entire collection later: recompute hashes for all items and compare them to the stored values in the manifest, or compare against known good values captured at the time of acquisition. If any item has been altered, its hash will no longer match, breaking the chain and signaling potential tampering. This approach supports integrity across related evidence and helps validate that the data remained unchanged through custody and handling.

Why not the other ideas? Encrypting data isn’t about verifying integrity, and a single hash of the whole dataset won’t reveal which item changed or handle additions well. Digital signatures can accompany the manifest to authenticate the data's origin, but the hash chain’s purpose is to preserve and verify the unaltered state of each item within the dataset.