Using hash values

All image files should be hashed after acquisition to ensure that data remains unchanged. If filesystem extraction is supported, the examiner extracts the filesystem and then computes hashes for the extracted files. Later, any individually extracted file hash is calculated and checked against the original value to verify the integrity of it. Any discrepancy in a hash value must be explainable (for example, the device was powered on and then acquired again, thus the hash values are different).