02 / FILE INTEGRITY AND EVIDENCE HANDLING · LESSON 07

Write a traceable evidence manifest

Export a reusable manifest that pairs file identity with case context and byte counts.

12 min · learn at your pace

A hash needs context

A list of hashes alone leaves unanswered questions: which file did each describe, and which case did it belong to? A manifest puts identity and provenance beside the fingerprint. Here, the case is LAB-104 and the source is supplied-export. Those labels describe this teaching dataset, not an actual evidence acquisition.

Build one custom object per file, then export the object collection. Keep Name, Bytes, and SHA256 as distinct fields. Length from Get-ChildItem is the file's byte length; the character count of text read into memory is not a reliable substitute for arbitrary encodings.

Export data that can be imported

Export-Csv handles quoting for you. Do not construct rows with string concatenation: filenames may contain commas or quotes. -NoTypeInformation keeps the first line as the column header across PowerShell versions.

[pscustomobject]@{ CaseId='LAB-104'; Source='supplied-export'; Name='example.txt' }

Save the report outside the evidence directory. Re-import it to check what you actually wrote, rather than trusting a pretty terminal display. CSV values return as strings, so the report consumer should deliberately parse Bytes when doing arithmetic.

This manifest is a reproducible summary of supplied files. It does not claim collection times, original owners, or custody events that the dataset does not provide.

Try an example.ps1

Get-ChildItem '/home/user/evidence' -File | Select-Object Name, Length

YOUR TURN

Put it into practice.

Write /home/user/manifest.csv with one row for each evidence file and columns CaseId, Source, Name, Bytes, SHA256. Use CaseId LAB-104, Source supplied-export, actual byte lengths, and SHA-256 hashes. Keep the evidence unchanged. Console output is optional.

See an explained solution

One way to solve it.ps1

$manifest = @(Get-ChildItem '/home/user/evidence' -File | ForEach-Object {
    [pscustomobject]@{ CaseId='LAB-104'; Source='supplied-export'; Name=$_.Name; Bytes=$_.Length; SHA256=(Get-FileHash -LiteralPath $_.FullName -Algorithm SHA256).Hash }
})
$manifest | Export-Csv '/home/user/manifest.csv' -NoTypeInformation

Custom objects retain the report schema until Export-Csv serialises it. Hashes and byte lengths come from the same literal file paths, and the report stays outside the evidence folder.