What does tamper evident mean: the term explained
Tamper evident describes a control that makes alteration of a record or a container detectable after the fact rather than impossible, so anyone who checks can tell whether something changed, even though nothing physically stopped the change from being made.
Written either way, tamper evident or tamper-evident, the term is a promise about detection. It is not a promise about prevention, and the two get conflated constantly in vendor copy and, more damagingly, in witness statements.
Tamper evident is not tamper proof
The difference is easiest to see in physical security, where the vocabulary has been settled for years.
- Tamper evident. A seal, coating or enclosure that shows visible signs when it has been opened. Anyone can still open it. They cannot open it invisibly.
- Tamper resistant. A construction that makes opening it hard, slow, or expensive. Attackers with enough time and skill still get through.
- Tamper responsive. A mechanism that detects an attempt in progress and reacts, typically by destroying the protected material.
- Tamper proof. A marketing word. Nothing in the standards literature carries it, because nothing earns it.
NIST's cryptographic module standard draws exactly this line between its levels. Security Level 2 requires physical tamper evidence, delivered through mechanisms such as tamper-evident seals or coatings. Level 3 goes further and requires tamper resistance with a high probability of detecting and responding to attempts at physical access, including circuitry that zeroises plaintext keys when a cover is opened. Evidence and response are separate requirements at separate levels, deliberately.
How tamper evidence works on digital records
A digital file has no seal to break. Nothing about a copied video looks different from the original, and there is no equivalent of a scuffed sticker. So digital tamper evidence is built by recording something about the content at a known moment, in a way that cannot be recomputed to match a later edit.
- A hash of the content. Recomputing the hash function output later and comparing it against the stored value answers one question exactly: is this still byte for byte the file we recorded? See digital fingerprint for how that value behaves.
- A signature over that hash. A cryptographic signature stops someone from simply updating the stored hash alongside the edited file, because they cannot produce a valid signature without the private key.
- An append-only record. A sequence where each entry commits to the one before it means a change in the middle breaks everything downstream of it.
- An externally held value. A hash lodged with a third party, or a trusted timestamp token over it, removes the argument that the checker also controls the reference.
Notice what none of those do. They do not prevent anyone from editing the file. Anyone with a copy and an editor can change it freely. What they prevent is passing the changed version off as the original.
Tamper evident example: the resized photograph
A property damage photograph is received in March and hashed on arrival. In September a copy in the case folder is compared against the stored value and does not match. The mismatch is real and it is detected, which is the control working.
It does not say what happened. In practice the usual cause is innocent: someone downloaded the image, resized it for a report, and saved the smaller version back into the folder. Tamper evidence produced a question, and a person answered it. That is the correct division of labour, and treating the mismatch as an accusation would have been wrong.
Why the wording matters when you are challenged
Precision here is not pedantry, it is self-protection. An assessor who tells a hearing the evidence is tamper proof has made a claim that can be falsified by one competent question, and once that claim falls the rest of their testimony carries less weight. An assessor who says alteration would be detectable, and can explain how, is describing something that holds up.
Two further limits belong in the same breath, because they are where confident language does the most damage.
- Detection is retrospective. Tamper evidence tells you a file changed after the reference value was recorded. Anything done before that moment is inside the sealed record, not outside it.
- An intact seal is not a truthful scene. A perfectly verified file can show a staged, borrowed, or misleading situation. Integrity controls address provenance. They do not address honesty.
That second point is worth stating explicitly to any team relying on these controls. Harder to manipulate does not mean impossible to deceive, and the evidence integrity and sealed submission entries treat it as the starting assumption rather than a caveat. Our guide to AI-generated insurance fraud covers what happens when the fabrication occurs upstream of any seal.
Venta Capture, a product of VentaVid, is built on tamper-evident controls in this precise sense: SHA-256 fingerprints on arrival, a signed seal that can be verified with a public key, and a recorded session timeline. Alteration after receipt becomes detectable. Nothing about that makes deception impossible, and the assessment stays with the qualified human.