When file integrity checking is enabled, what feature is used to determine if a monitored file has been modified?

File size only changes when bytes are added or removed; an attacker can modify file contents while preserving the original size, making this check insufficient.

Last modified date is a filesystem metadata attribute that can be trivially reset by an attacker using tools like 'touch', so it cannot reliably indicate whether content was altered.

Application Event Log file change notifications rely on the OS logging subsystem, which an attacker with sufficient privileges can clear or disable, and they do not provide a cryptographic proof of content integrity.

A one-way hash (such as SHA-256) produces a fixed-length digest that is uniquely representative of the file's exact byte content; even a single changed bit results in an entirely different hash, making tampering immediately detectable when the stored baseline hash is compared to a newly computed hash. This cryptographic property makes it far more reliable than metadata-based checks, which can be easily manipulated by an attacker.