Which of the following techniques will identify if computer files have been changed?

Network sniffing captures and analyzes packets traversing a network interface and has no mechanism to inspect or compare the contents of files stored on disk.

Permission sets define read, write, and execute access controls but do not record or compare file content to detect changes made by users who already have access.

Integrity checking uses cryptographic hash algorithms such as MD5, SHA-1, or SHA-256 to produce a fixed-length digest of a file's contents at a known-good state. If any byte in the file is subsequently altered - whether by malware, unauthorized editing, or corruption - the recomputed hash will differ from the stored baseline hash. Tools such as Tripwire and built-in OS utilities implement this approach as file integrity monitoring (FIM).

Firewall alerts are triggered by network traffic rule violations and operate at the network boundary, not at the file system level.