Digital Evidence Integrity System Using SHA-256 Hashing for Digital Forensic Data Tracking

Abstract

This study presents the design and implementation of a digital forensic system that integrates an audit trail mechanism with the SHA-256 hashing algorithm to track data changes and detect unauthorized manipulation, without depending on a blockchain architecture. Using a Design Science Research approach, the system called the Digital Evidence Integrity System was built as a web application with PHP and MySQL, covering requirement identification, model design, implementation, an integrity validation mechanism, and testing and evaluation. Evaluation began with a pilot of five records under authorized and unauthorized update scenarios that simulated direct database access, then was expanded to sixteen scenarios spanning seven manipulation categories: insert, update, deletion, replay, concurrent access, stored-hash alteration, and audit-trail-log manipulation. Across the fourteen scenarios usable for a confusion matrix, the system correctly flagged 4 of 9 genuine manipulation attempts (a 44.4% detection rate) with zero false positives on legitimate changes, while consistently failing to detect four categories of manipulation: outright deletion of a record, replay of a superseded but internally valid data-hash pair, an attacker recomputing and overwriting the stored hash together with the data, and tampering with the audit-trail log itself. A repeated one-character perturbation test (60 trials) confirmed the avalanche effect of SHA-256, with a mean Hamming distance of 126.42 of 256 bits (49.38%, SD 8.52) between the hash of the original and the perturbed input. Taken together, these findings indicate that an audit trail combined with SHA-256 hashing is computationally lightweight and reliably detects manipulation that alters data without also updating its stored hash, but is not, in its current form, a sufficient safeguard against an attacker capable of also controlling the hash or the log; protecting the audit-trail log itself, adding a genuine user-authentication mechanism, and closing the deletion, replay, and stored-hash-alteration gaps identified here are the priorities for further development before the system could be relied upon in an operational forensic setting.