A county uses remote collection that hashes files before transfer to the evidence share. What artifact-handling goal does that automation serve?

A county that uses remote collection hashing files before transfer to the evidence share is performing integrity-preserving automated artifact collection. Computing a cryptographic hash on the source before the copy starts creates a verifiable seal: after transfer, the evidence share can re-hash and prove the bytes match what left the endpoint. That supports municipal chain-of-custody, dispute defense, and later forensic reuse when auditors or prosecutors ask whether the civic evidence package was altered in flight.

Confidentiality-preserving automated artifact collection with hashes before evidence transfer misstates the goal because hashing proves the bytes are unchanged, not that they were kept secret, which would require encryption and access controls. Efficiency-preserving automated artifact collection with hashes before evidence transfer misstates the goal because hashing adds verification to prove integrity, not to make collection faster or lighter. Availability-preserving automated artifact collection with hashes before evidence transfer misstates the goal because hashing proves the transferred copy matches the source, not that the evidence remains accessible or replicated when needed. Preserving source artifacts for at least the duration of the investigation—and ideally per the evidence retention policy—allows verification steps to be re-run if needed.

Exam caveat: Hashing before transfer is not the same as retention policy. Set a minimum hold time for source artifacts (e.g., 90 days minimum, longer for sensitive incident classes) and document the retention schedule in your incident response runbook.

Operational check: Configure remote collection to hash all artifacts at source before transfer; test transfer and verify re-hash on the evidence share; document the hash algorithm (SHA-256) and store it alongside the artifact; and confirm that source artifacts are not automatically purged until the incident retention period expires.