b2KIT

Evidence Hash Chain Builder

Build a tamper-evident hash chain for digital evidence. Each file gets a timestamped hash linked to the previous entry.

Tested tool guide Tested browser tools Checked August 16, 2026

What Evidence Hash Chain Builder does and how it behaves

Evidence Hash Chain Builder creates an ordered manifest for digital evidence. For each selected file, it records a cryptographic hash and timestamp, then links the entry to the one before it. The resulting chain can expose later changes to file contents, entry order, or recorded links when compared with the preserved original. Files are processed in the browser and are not uploaded. The important limitation is that a consistent chain does not prove who collected the evidence, when the underlying event occurred, or who controlled the files afterward.

How the result is produced

1

Ordered evidence entries

Each entry identifies one file through its hash and records a timestamp and a link to the preceding entry. The first file starts the sequence because no earlier evidence entry exists. Later entries depend on the chain position before them, so processing the same files in a different order produces a different chain record.

2

Tamper-evident comparison

The chain becomes useful when its original result is preserved for comparison. If file bytes or an earlier entry change, the recorded hash or following link will no longer agree with that baseline. A hash chain is not self-authenticating: someone who can replace both the evidence and the only saved chain record could construct a new, internally consistent chain.

Good uses

  • Record the order and integrity hashes of photographs, videos, and documents immediately after a digital evidence collection.
  • Create a linked manifest for log exports, memory captures, and configuration snapshots gathered during an incident response investigation.
  • Package source files for an audit or internal inquiry so recipients can compare their copies with a separately preserved chain record.

Limits and checks

  • A matching chain supports byte-level consistency with the preserved baseline, but it does not establish authorship, provenance, or continuous custody.
  • The timestamp should not be treated as independent proof that a file existed at that time unless the result is separately authenticated by a trusted timestamp or signing process.
  • Adding, removing, replacing, or reordering files changes the chain. A mismatch reveals inconsistency but does not identify whether the cause was tampering, accidental editing, or different input order.

Common questions

Can this result serve as a complete chain-of-custody record?

No. It records an ordered relationship among file hashes and timestamps, which can support later integrity checks. A complete custody record also needs documented acquisition methods, responsible people, transfers, storage controls, access history, and preserved originals. Depending on the setting, signatures or independently trusted timestamps may also be required.

What must I preserve after building the chain?

Preserve the complete chain result, the exact file order, and the evidence files under controlled storage. Keep an independently protected copy of the result, especially its final linked value. If the only chain record remains beside files that another person can replace, that person may be able to alter the files and build a new consistent record.

References and verification

The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools