The problem
Cryptographic integrity is essential but proves less than people wish. A hash matches a specific byte sequence; it cannot independently verify who made the file, what a camera recorded, or whether content was staged.
Analytical approach
Combine hashes with authenticated acquisition context, trusted time, independent provenance and witnessable collection procedures.
Falsifiable test
Produce two identical-byte copies with different stated origin stories to demonstrate the boundary.
Operational implications
A defensible workflow should record the exact input, collection method, version, context, counter-explanation and reason for the conclusion. Reviewers should be able to disagree with the inference without losing the underlying observation. When this topic is applied to a real investigation, safety, lawful authority and domain-qualified professional guidance take precedence over a generic article.
Next research step
Publish a small case study with a documented baseline, an adversarial or failure-mode control, outcome criteria and enough data to reproduce the result. Report inconclusive findings alongside successes. This page is a research primer, not a claim that the proposed test has already been performed.
Source and revision record
Original editorial analysis and definitions. For background reference, consult the source catalog.