Build a file hash inventory
Compute SHA-256 hashes of supplied evidence files without changing their contents.
Identify bytes, not a verdict
A cryptographic hash is a compact fingerprint of a file's bytes. SHA-256 helps compare a current file with a trusted earlier copy. A matching hash does not mean the file is safe, and an untrusted baseline cannot establish authenticity.
Get-FileHash returns an object containing Algorithm, Hash, and Path. Choose SHA256 explicitly so the script states its contract. A zero-byte file also has a hash; it should not disappear from the inventory.
Treat filenames literally
One supplied filename contains square brackets. Parameters that accept wildcard paths can interpret those characters as a pattern. Use -LiteralPath when a path came from a file listing and you mean that exact file.
Get-ChildItem '/home/user/evidence' -File |
Select-Object Name, Length
Keep the input folder separate from your reports. Writing a report into the evidence folder can make the next run hash its own previous output. This task emits objects only and does not modify evidence.
These are fabricated text files in a browser filesystem. A real evidence-handling process also needs collection authority, original media protection, provenance, timestamps, access records, and an appropriate chain of custody. Hashing is one useful operation within that process; it does not supply the rest.
Go deeper
Get-FileHash -LiteralPath '/home/user/evidence/notes.txt' -Algorithm SHA256
Put it into practice.
Inventory all three files directly inside /home/user/evidence. Emit one object per file with Name (the basename) and SHA256. Include the empty file and the filename containing brackets. Leave the input files unchanged.
See an explained solution
Get-ChildItem '/home/user/evidence' -File | ForEach-Object {
[pscustomobject]@{ Name=$_.Name; SHA256=(Get-FileHash -LiteralPath $_.FullName -Algorithm SHA256).Hash }
}
Enumeration includes zero-byte files, and literal paths protect bracketed filenames from wildcard interpretation. SHA-256 is computed on the original bytes rather than a reformatted text representation.