What is a forensic examiner confirming when they create a cryptographic hash, such asMD5 or SHA1, of a file?

Authentication refers to verifying the identity of a user or system, not confirming that a file's contents remain unchanged.

Integrity verification ensures that data has not been modified, corrupted, or tampered with. By generating a cryptographic hash of a file at acquisition time and later recomputing the hash, a forensic examiner can confirm that the bit-for-bit copy matches the original - any change to the file, however small, produces a completely different hash value. This process forms the foundation of the chain of custody in digital forensics.

Confidentiality refers to protecting data from unauthorized disclosure, typically achieved through encryption - hashing does not encrypt or conceal data.

Authorization refers to granting or restricting access permissions to resources, which is unrelated to verifying a file's unaltered state.