Description
Currently, Evidence Protector validates evidence integrity using hashes, but there is no straightforward way to compare two evidence snapshots and identify changes between them.
Adding an Evidence Snapshot Comparison feature would allow investigators to quickly verify whether files have been modified, added, or removed between two evidence collections.
Proposed Solution
Implement a comparison module that:
Allows users to select two evidence snapshots/packages
Compares:
File names
File sizes
Hash values (SHA-256/MD5)
Timestamps
Highlights:
Added files
Deleted files
Modified files
Unchanged files
Displays results in a tabular format with filtering options
Description
Currently, Evidence Protector validates evidence integrity using hashes, but there is no straightforward way to compare two evidence snapshots and identify changes between them.
Adding an Evidence Snapshot Comparison feature would allow investigators to quickly verify whether files have been modified, added, or removed between two evidence collections.
Proposed Solution
Implement a comparison module that:
Allows users to select two evidence snapshots/packages
Compares:
File names
File sizes
Hash values (SHA-256/MD5)
Timestamps
Highlights:
Added files
Deleted files
Modified files
Unchanged files
Displays results in a tabular format with filtering options