Hash chains and chain of custody, explained without the jargon

"Tamper-evident" and "hash-chained" sound like cryptography jargon, but the underlying idea is simple: make it mathematically obvious if a record was changed after the fact. Here's how, in plain terms.

What a hash actually is

A cryptographic hash is a function that takes any input, a document, a paragraph, a whole file, and produces a fixed-length string of characters that looks random. Two properties matter here: the same input always produces the same hash, and changing even one character of the input produces a completely different hash. There's no way to predict how the hash will change just by looking at the edit.

That means a hash works as a fingerprint. If you have a document and its hash, you can always check later whether the document has been altered: just re-compute the hash and compare.

What "chaining" adds

A single hash proves one document hasn't changed. A chain proves something stronger: that the entire sequence of events, in order, hasn't been altered, reordered, or had entries quietly inserted or removed. Each new event's hash is computed using both its own content and the hash of the event immediately before it:

Change anything about event 2, even years later, and hash_2 no longer matches what it should be, which means hash_3 and hash_4 no longer match either. The break is visible all the way down the chain. There's no way to slip in an edit without it showing up.

Where "write-once" storage fits in

Hash-chaining proves that IF something changed, it's detectable. Write-once storage (sometimes called WORM, for write once, read many) is what makes silent deletion or replacement of a record physically impossible in the first place, rather than merely detectable after the fact. Together, the two give you both prevention and verification.

Chain of custody: who touched the record, and when

Chain of custody is a related but separate concept: a log of every time a record was accessed, exported, or downloaded, by whom, and when. It answers a different question than the hash chain does. The hash chain proves the record's content wasn't altered; the custody log proves who has actually seen or handled it, which matters when a party in litigation or a regulator asks "who has had access to this evidence since it was created?"

Why this matters more than it sounds like it should

In an appeal, audit, or lawsuit over a denial, the other side's first move is often to question whether the record being presented is the same one that existed on the day the decision was made. A hash chain with an independently verifiable manifest lets a skeptical third party check that claim for themselves, rather than being asked to simply trust it.