ByteCase by Forensics ByteExplore Tools

Integrity and Hashing

Understanding Hash Verification Results

How to interpret matching, changed, missing, new, inaccessible, skipped, path-changed, and error results during hash re-verification.

By Matthew McBride Reviewed June 25, 2026 8 minutes

A comparison needs more than pass or fail

Folder verification can produce several different conditions. Reducing all of them to “failed” hides useful information.

Match

The current file was located and its calculated value matches the original manifest.

Mismatch or changed

The file was located, but its current hash differs.

Possible causes include modification, corruption, replacement, export changes, accidental overwrite, or selecting the wrong source. The result identifies a difference; it does not determine the cause.

Missing

The manifest contains a record, but no current file was found at the expected location.

Possible causes include deletion, incomplete transfer, a different source root, renamed folders, or selecting the wrong verification target.

New or unexpected

A current file exists but was not present in the original manifest.

This may indicate a later report, log, or export; a file addition; or a different source selection. New does not automatically mean improper.

Inaccessible

The file exists, but the application could not read enough data to calculate its hash.

Common causes include permissions, file locks, offline storage, read errors, endpoint-security interference, or filesystem limitations.

Skipped

The file was intentionally or automatically omitted. The reason should be visible, such as an exclusion rule, unsupported object type, user cancellation, symbolic-link policy, or duplicate-processing policy.

Path changed

Matching content may exist under a different path. A tool should not silently assume that a matching hash at a new location represents the same investigative object. Path reconciliation should remain examiner-controlled.

Error

An unexpected application, operating-system, or filesystem condition prevented a reliable comparison.

Preserve:

  • Affected path
  • Operation attempted
  • Error message or code
  • Time
  • Whether processing continued
  • Application version
Total manifest records: 1,248
Matched: 1,241
Changed: 1
Missing: 2
New: 3
Inaccessible: 1
Errors: 0

The report should then list the affected paths and details.

Where ByteCase Verify fits

ByteCase Verify is designed to preserve these categories instead of reducing the comparison to one green or red result.