Digital fingerprint (SHA-256 hash)
What is a digital fingerprint: the SHA-256 hash explained
A digital fingerprint is a short value calculated from the exact contents of a file, almost always using the SHA-256 hash function, so that the same file always produces the same value and changing anything at all, even one pixel in one frame, produces a completely different value.
The calculation behind it is standardised by the US National Institute of Standards and Technology in FIPS 180-4, the Secure Hash Standard, first approved in March 2012.
What does a SHA-256 hash mean in plain terms?
SHA-256 turns a file of any size into a 256-bit value, normally written as 64 characters of hexadecimal. A three-second voice note and a two-hour 4K video both produce a fingerprint of exactly that length.
Three properties make it useful for evidence handling rather than a curiosity:
- It is deterministic. The same input always produces the same output, on any machine, in any software, years apart.
- It is one-way. You cannot reconstruct the video from the fingerprint, so publishing the value gives nothing away about the content.
- Small changes cascade. Flipping a single bit changes roughly half the output bits. There is no such thing as a nearly matching hash. It matches or it does not.
That last property is the one to explain to a claims or operations team. People expect a small edit to produce a small difference. It does not. Re-saving a photo at a slightly different compression level produces a value with no visible relationship to the original.
How a digital fingerprint works in a case file
Record the fingerprint when a file arrives, and you can answer one question at any point in the future: is this still the exact file we received? Recompute the SHA-256 hash of the file in front of you and compare it with the stored value. Identical means the content has not changed by a single byte. Different means something happened, whether that was tampering, a well-meant re-encode for a report, or a corrupted copy on a shared drive.
Digital fingerprint example: which file did we decide on?
Damage is captured on day one and the claim is paid in week three. Eight months later the file is reopened and three versions of the same photo sit in different folders, two of them resized for a report. Comparing each against the stored SHA-256 hash identifies which one is the file the system actually received.
What the match does not tell anyone is whether that photo showed genuine accident damage. It settles the provenance question and leaves the assessment question open.
What a SHA-256 hash does not prove
Precision here is not pedantry. It decides whether the fingerprint helps you in a dispute or gets picked apart in one.
- It does not prove what the file depicts. A hash says the bytes are unchanged. It says nothing about whether the dent was genuine, staged, or photographed on a different vehicle.
- It does not prove who created the file, or which device produced it. Signatures, keys and session records cover that.
- It does not prove when the depicted event happened. Pairing a fingerprint with a server-side receipt timestamp proves the file existed in this exact form at the moment the system received it. The damage could predate that by any amount.
Together, a fingerprint plus a receipt time supports one defensible statement: this exact content was in our possession from this moment onwards. It is a narrow claim, and it is useful precisely because it is narrow.
How to verify a digital fingerprint yourself
Nothing about verification depends on the platform that produced the file. On macOS or Linux, shasum -a 256 filename prints the value. On Windows, certutil -hashfile filename SHA256 does the same. Compare the output against the recorded fingerprint.
That independence is the point. A hash checked only inside the system that generated it asks the other side to trust that system. A hash anyone can recompute with standard tools does not.
Is SHA-256 still strong enough?
Yes, for this purpose. No practical collision, meaning two different files sharing one fingerprint, has been produced against SHA-256, which is why it remains the working default for file integrity in NIST guidance. Its predecessor SHA-1 is a different story and was broken in practice years ago, so treat any system still quoting SHA-1 values as out of date.
The fingerprint is one layer among several. On its own it tells you a file is unchanged. Combined with capture-time controls, a receipt timestamp, a session record and a signed seal, it becomes part of a chain you can walk someone through. Our guides to photo evidence in insurance claims and AI-generated insurance fraud explain why the other layers are needed, since a perfectly hashed file can still be a fabricated one if the fabrication happened before it arrived.
Venta Capture, a product of VentaVid, applies a SHA-256 digital fingerprint to every file on arrival, alongside 28 control points per submission, a signed seal that can be verified with a public key, GPS location, and GDPR-compliant storage with configurable retention.
