LEARN. PRACTICE. GROW.Equal totals can hide differences
In the lab, the copy contains A=50, B=250 and C=300. A second file shows A=75, B=225 and C=300. Both contain three rows totaling 600, but the allocation changed. Counts and sums are useful controls for detecting some failures without constituting complete comparison. If the decision depends on balances by holder, compare relevant keys and values. Do not confuse offsetting errors with successful reconciliation. Also document the unit: 600 cents is not 600 euros. The exercise uses integers so that record differences are not mixed with floating-point rounding effects.
What a hash can check
SHA-256 is calculated over the first CSV’s bytes and retained as the exercise reference. The altered CSV produces another value. Comparing a received file with a protected earlier reference can detect changes to these bytes. However, if whoever replaces the file also supplies a new hash, a match between the new file and that hash does not establish origin. A line-ending change can alter bytes without changing interpreted values; legitimate transformation requires documentation. Distinguish binary comparison from semantic comparison. The lab establishes neither sender identity, transaction authorization nor legal validity of evidence.
Preserve the source and work on a copy
A workpaper should allow a reviewer to trace who acquired evidence, where from, when, under which authorization and through which steps. Retain the original extract under applicable rules and perform transformations on an identified copy. Record filters, code, versions, parameters and exclusions, including results that contradict the initial hypothesis. A spreadsheet without history can hide manual corrections; export its logic or document it for reperformance. If disciplinary or judicial use is anticipated, involve accountable specialists and applicable procedures. A hash and a ticket alone do not establish that every preservation requirement has been satisfied.
Repeat the calculation and challenge scope
A second auditor receives the frozen copy and procedure. They should reconstruct count, total and exceptions without relying on undocumented verbal instructions. If results differ, first compare data version, parameters, ordering where relevant and transformation. Avoid choosing the execution producing the most favorable conclusion. Reproducibility has a limit: two people can execute the same incorrect query and obtain the same answer. The reviewer should also challenge whether filters match the question and whether sources are missing. In a migration, a key-based sample comparison can expose swapped values that aggregate totals do not detect.
Reporting proportionate to evidence
If the only demonstration is that a copy retains three rows totaling 600, state that conclusion. Claiming migration correctness requires additional criteria about content, scope and transformations. Claiming transaction authorization requires linking records to evidence for that control. When origin cannot be confirmed, communicate the limitation and its effect on the conclusion rather than substituting personal trust in a supplier. Coordinate access and retention to protect sensitive data while enabling authorized review. In a fictional banking environment, APS helps explain extraction behavior while the auditor retains responsibility for assessing evidence sufficiency and appropriateness.
# Inspect the JSON evidence from the preceding lab.
# Compare observations.originalRows and observations.alteredRows.
# Both totals are 600 cents; per-key amounts and SHA-256 differ.
# A newly supplied hash does not independently authenticate origin.
Two CSVs have equal counts and sums but different balances by key. A hash identifies changed bytes when compared with the earlier reference.
Common pitfalls
Equal totals as equal values; hash as identity; reperformance as query correctness; favorable results as the only results to retain.
Related topics: Populations and workpapers · Databases and operations · Integrity and provenance
Preserve the evidence path and limit each conclusion to what the controls actually establish.
Reference: Guide to Integrating Forensic Techniques into Incident Response · CISA outline effective August 1, 2024