If an evidence file has been added to a case and verified, what happens if the data area is altered later?

When an evidence file is added to a case and verified in EnCase, the integrity of the data is ensured through the validation of hashes. If the data area is altered after this verification, the correct understanding is that EnCase will not automatically detect this alteration unless the evidence file is manually reverified.

When you access an evidence file, EnCase checks against the expected hash values to determine if any changes have occurred. If the file has been verified initially, an alteration does not trigger an immediate alert unless a manual reverification is performed. The integrity check does not continuously monitor the file; hence, without a manual recheck, the alterations could go undetected until access triggers a measure to verify.

In essence, the manual reverification serves as a critical checkpoint to ensure that the evidence has not been tampered with since its initial verification. This reinforces the importance of regularly verifying evidence to maintain its integrity throughout an investigation.