EVIDENCE COVERAGE AND UNRESOLVED CLAIMS IN DIGITAL FILE INTEGRITY ASSESSMENT
Keywords:
digital file integrity, metadata, structural analysis, visual forensics, trusted baseline.Abstract
Integrity assessment can be incomplete even when every executed check returns a plausible result. This paper models the coverage of a requested claim using applicable evidence, unavailable inputs and contradictory findings. A three valued support relation distinguishes supported, contradicted and unresolved requirements. A coverage matrix connects authenticated digest comparison, provenance and file-specific observations to distinct questions. The analysis derives a stopping condition for a bounded claim and demonstrates why missing reference data cannot be compensated by additional visual indicators. The resulting framework specifies both the conclusion and the precise evidence still required for review.
References
[1] National Institute of Standards and Technology, Secure Hash Standard (SHS), FIPS PUB 180-4, 2015. DOI: 10.6028/NIST.FIPS.180-4.
[2] K. Kent, S. Chevalier, T. Grance and H. Dang, Guide to Integrating Forensic Techniques into Incident Response, NIST SP 800-86, 2006. DOI: 10.6028/NIST.SP.800-86.
[3] ISO 32000-2:2020, Document management – Portable document format – Part 2: PDF 2.0. Geneva: ISO, 2020.
[4] ITU-T, Information technology – Digital compression and coding of continuous-tone still images – Requirements and guidelines, Recommendation T.81, 1992.
[5] W3C, PROV-DM: The PROV Data Model, W3C Recommendation, April 30, 2013. https://www.w3.org/TR/prov-dm/.
[6] N. Krawetz, A Picture’s Worth: Digital Image Analysis and Forensics. Hacker Factor Solutions, 2007.
[7] L. Verdoliva, “Media Forensics and DeepFakes: An Overview,” IEEE Journal of Selected Topics in Signal Processing, vol. 14, no. 5, pp. 910–932, 2020. DOI: 10.1109/JSTSP.2020.3002101.
