Before handing exported firewall logs to legal counsel, an investigator must be able to demonstrate later that the files have not been modified since they were collected. What should the investigator do at the time of collection?

Integrity is demonstrated by comparison against a value recorded at collection time. A cryptographic hash function produces a fixed-length digest that changes completely if even one bit of the input changes, so hashing each log file when it is exported and recording the digests in the chain-of-custody documentation creates a baseline. Recomputing the hashes later and getting identical values shows the files are unaltered since collection. Compressing files into an archive changes their storage format but provides no proof of integrity; anyone can extract, edit, and re-archive the contents, and the archive itself has no recorded reference value unless it is hashed. Encrypting with a symmetric key protects confidentiality, and because the investigator holds the key, the investigator could decrypt, edit, and re-encrypt without detection, which defeats the purpose of proving the files are unchanged to a third party. Converting to a read-only document format is a file attribute or presentation choice, not a cryptographic control; the content can be regenerated or the attribute removed. Exam caveat: hashing proves the file has not changed since the hash was taken, not that the log was accurate when written, which is why centralized, append-only log collection matters too. Operational check: record each file's digest with the time and collector's name, and recompute before every transfer.