What breaks when organisations try to authenticate a file, a person, and an event with the same evidence?

Why one kind of evidence cannot prove three different things

The failure is a category error: authenticity is not the same as identity, and identity is not the same as event truth. A file hash can show that a file has not changed, but it cannot tell you whether the contents are true, current, or contextually complete. A face, voice, or byline can be genuine and still be used in a misleading or synthetic way. A recording can be real and still be attached to the wrong moment.

That distinction matters because investigators often inherit evidence that is technically sound but semantically incomplete. When the same artefact is asked to prove integrity, authorship, and chronology at once, the result is usually overconfidence. The better question is which claim the evidence can actually support, and which claim still needs independent corroboration.

What each evidence type can and cannot answer

File integrity evidence answers a narrow question: has the file been altered since a known reference point? Hashes, signatures, and chain-of-custody records are useful for that purpose, but they do not establish who said something, when it was said, or whether a real-world event occurred. They only make the file itself easier to trust.

Identity evidence answers a different question: does this person, account, or source correspond to the claimed individual? Reference media, enrollment records, verified accounts, and trusted attestations can help, but they do not by themselves prove that a statement was not generated, edited, or taken out of context.

Event evidence is separate again. Logs, timestamps, corroborating systems, and witness testimony help establish that something happened, in what sequence, and under what conditions. That is why a sound investigation usually triangulates across artefact integrity, source identity, and event reconstruction instead of collapsing them into one test.

How the confusion shows up in practice

The most common mistake is treating a real source as proof of a real claim. A genuine person can be quoted saying something they never actually said, especially when audio, image, or text is detached from the original context. Likewise, a tampered file may still contain a real recording, so the presence of authentic media does not guarantee that the surrounding file, caption, or timeline is trustworthy.

Another failure mode is assuming a single verification step can stand in for the whole investigation. A hash check is valuable, but if the file was collected from an untrusted channel, integrity alone leaves you exposed to provenance problems. Likewise, identity checks can be strong while the event itself remains unverified, which is how manipulated material gains undue credibility.

For investigators and defenders, this is a source of false confidence rather than outright blindness. The evidence may be genuine, yet still point to the wrong conclusion if the claim being tested is broader than the evidence can support.

Risk and Threat Considerations

When organisations collapse file integrity, identity proof, and event verification into one control, they create a predictable trust gap. Attackers and deceivers benefit because one authentic element can be used to lend credibility to a false narrative, a forged context, or a misleading timeline.

Failure mechanism: A real artefact, real person, or real event fragment is presented as if it proves all three, so the reviewer stops searching for independent corroboration. That is how authentic material can be repurposed into deceptive evidence.

Impact: Decisions based on mixed evidence can be wrong even when each individual artefact looks legitimate. The result can be incorrect attribution, failed incident reconstruction, weak legal or disciplinary outcomes, and overconfidence in material that only proves one layer of the claim.

Practitioner Guidance

What to verify: Treat the question as three separate checks. First, verify artefact integrity. Second, verify source identity. Third, verify the event timeline or occurrence through independent records. If one check is missing, do not let the other two silently cover for it.

Decision rule: If the evidence could plausibly support more than one interpretation, require at least one independent source for each material claim. Use hashes or signatures for the file, reference media or provenance for the person, and logs, timestamps, or witnesses for the event.

Practitioner takeaway: The strongest evidence is not a single “truth” signal, it is a set of different signals that each answer a different question without overreaching.

Related resources from NHI Mgmt Group

• What breaks when organisations try to govern all identities with the same access model?
• What breaks when organisations authenticate a token instead of the person behind it?
• What breaks when organisations try to manage CMMC evidence with spreadsheets and ad hoc documentation?
• What breaks when organisations try to manage cloud applications with the same tree-based model used for LDAP?