A cryptographic hash is a compact value calculated from a file’s bytes. If those bytes change, the hash value should change. NIST’s Secure Hash Standard specifies SHA-256 among the approved secure hash algorithms.
What the manifest should contain
- Relative path and original filename
- Extension and file size in bytes
- Last-write timestamp in UTC
- SHA-256 value
- Full path or controlled storage identifier
- Error log for every file that could not be read
Keep the manifest outside Originals
If the manifest is written into the source folder, the source set changes and later runs may hash the manifest itself. Save the CSV and its readback beside the originals folder instead.
Do not treat a hash as magic
A matching hash supports the narrow statement that the compared bytes match. It does not prove who created the file, whether the file is complete, or whether the underlying information is true. Provenance and content review still matter.
The Evidence Kit includes a Windows tool that performs this inventory and writes both the CSV manifest and a JSON readback with file count, byte total, manifest hash, and errors.