What 'forensic-grade' means in academic integrity: a plain-language guide for administrators

The short answer

"Forensic-grade" means evidence meets the standard for authentication in formal proceedings: it hasn't been altered, there is a verifiable record of who held it and when, and the verification can be performed by anyone without trusting the party that produced it.

Most writing evidence that institutions currently present in integrity proceedings does not meet this standard. Understanding why — and what would — is becoming increasingly urgent as students challenge findings in courts and before external review bodies, and as those bodies are increasingly ruling against institutions.

---

What "tamper-evident" means — and what it doesn't

Two terms are often used loosely in vendor materials: tamper-proof and tamper-evident. They are not the same thing, and the difference is consequential.

A tamper-proof record is one that cannot be altered. No digital record meets this description. Every digital file is bytes on a disk somewhere, and whoever controls that disk can modify those bytes. A database administrator can run an UPDATE query. A file owner can open a ZIP and edit the XML inside. A cloud provider retains theoretical access to everything it stores. "Tamper-proof" is a marketing claim, not a technical one.

A tamper-evident record is one where any modification produces a detectable signature. This is achievable — and it is the standard that actually matters for evidence.

The mechanism is cryptographic hashing. A hash function takes any input — a document, a database record, a log file — and produces a fixed-length output (the "hash" or "digest") with two key properties: first, the same input always produces the same output; second, a different input (even one byte changed) produces a completely different output. Computing the hash of the original content and storing it creates a reference point. Anyone who later receives the content can recompute the hash and compare it. If they match, the content is identical to what was hashed. If they don't, something changed.

This is not the same as being hard to modify. A Word document is hard to modify without an expert noticing, but it is not cryptographically tamper-evident — there is no hash anyone can recompute and compare. Version history in Google Docs looks comprehensive, but a publicly available tool (DocuSim) demonstrates that a visually identical version history can be generated from scratch. "Hard to fake" is not the same as "detectable if faked."

---

What a hash chain is

A single hash covers a single moment in time. A hash chain extends this across a sequence of events — each record in the chain includes the hash of the previous record. This means that modifying any record in the chain breaks all subsequent records: the hash stored in record N+1 will no longer match the content of the modified record N. To forge a hash chain, an attacker would need to recompute every record from the point of modification forward — and if any anchor point in the chain has been published externally (a timestamp service, a blockchain, an independent server), there is a reference that cannot be retroactively altered.

NIST SP 800-86, the standard reference for integrating forensic techniques into incident response, recommends exactly this approach for digital evidence: hash at acquisition, verify at every subsequent step, document the chain of handling between steps. These recommendations were developed for cybersecurity incidents, but the underlying evidence requirements are identical to those in academic integrity proceedings.

A writing record built on a hash chain offers the same guarantees: any alteration to the record — to the text, the timestamps, the metadata — is detectable by recomputing the chain. The verifier doesn't need to trust the platform that produced the record; they only need to recompute.

---

What "chain of custody" means for a writing record

Chain of custody is a legal concept, not just a technical one. It describes the documented record of who held a piece of evidence, and when, from the moment of collection to its presentation in proceedings. The point is to account for every opportunity for tampering — to show that no gap in the handling record exists where evidence could have been altered without anyone knowing.

The US Federal Rules of Evidence (Rule 901) require that evidence be "authenticated" — shown to be what it claims to be. For digital evidence, this means showing it hasn't been modified since collection. Chain of custody is how you demonstrate that.

Version history has no chain of custody in this sense. When an instructor presents a Google Docs version history, they are presenting data that Google controls — there is no documented record of who accessed the document between the writing event and the proceeding, no hash to verify, no external anchor. The chain runs through Google's servers with no verifiable link between the writing event and the presentation of the evidence.

A forensic-grade writing record has three properties that meet this standard:

1. Integrity — a cryptographic hash computed at the moment of capture, verifiable by any party without accessing the original system
2. Attribution — a documented record of what captured the evidence, on what system, at what time, with any subsequent handling logged
3. Continuity — coverage of the claimed writing period without unexplained gaps; a ten-minute record for a three-thousand-word essay is not a continuous record of composition

---

The Adelphi ruling and its implications

In February 2026, a court ruled against Adelphi University in a case where a student was penalized based on an AI detection score. The court found the university had acted "without valid basis and devoid of reason." This outcome was not a surprise to anyone who had read the evidence quality carefully: a detection score is an inference from a statistical model, not an observation of the writing event. It does not meet FRE 901's authentication requirement. A detector score is not "what it claims to be" — it is a probabilistic output that varies across tools, versions, and inputs.

The Adelphi case is not an isolated event. It is the leading edge of a pattern that the UK's Office of the Independent Adjudicator for Higher Education (OIA) identified in casework guidance: institutions that act on detector scores without corroborating evidence are in a weak position when students challenge the finding. The OIA's guidance is explicit — an AI detection score alone should not be treated as sufficient evidence of misconduct.

The direction is consistent: informal adjudications based on AI scores are being challenged and overturned. Institutions that want findings to be durable need evidence that can survive that challenge.

---

What a forensic-grade writing record looks like in practice

The standard is not aspirational. It describes systems that exist.

A forensic-grade writing record is:

• Captured during writing — not reconstructed after the fact from logs or version history, but recorded in real time as the student types
• Sealed at submission — a cryptographic hash is computed at submission time and stored immutably, creating the integrity anchor
• Verifiable by any party — anyone with the hash and the record can verify them against each other without logging into the platform that produced them
• Inclusive of a consent record — the student's consent to capture is documented as part of the sealed evidence, establishing that collection was lawful

Version history, screenshots, export PDFs, and detector scores do not meet this description. A process record built on a hash chain does.

---

Questions administrators should ask vendors

Before relying on any writing evidence tool in formal proceedings, administrators should obtain clear answers to four questions:

1. Does the record include a verifiable hash? Not "we store records securely," but "here is the hash algorithm, here is the stored hash, here is how you recompute it from the record."

   • Strong: "Records are sealed with SHA-256. The hash is embedded in the sealed document and can be recomputed from the exported record using any standard SHA-256 tool — here is the command."
   • Weak: "We use industry-standard encryption and our data is stored securely in AWS with multiple redundancy layers."

2. Can a third party verify it without logging into your platform? If verification requires a vendor account, the vendor is a trusted intermediary — there is no independent verification.

   • Strong: "Yes. We publish a verification page that accepts any exported sealed record and checks the hash without requiring an account. You can test it right now."
   • Weak: "Our enterprise customers can request a verification report through their dedicated account manager."

3. Is the consent record part of the sealed evidence? Consent captured separately from the record it authorizes is a weaker chain.

   • Strong: "The student's consent timestamp and the specific consent text they accepted are included in the data that is hashed at sealing — they are part of the sealed record, not a separate database entry."
   • Weak: "We store consent in our compliance database and can provide a consent confirmation on request."

4. What is the retention period for the sealed record? An appeal filed two years after the event needs the sealed record to still exist and be verifiable.

   • Strong: "Sealed records are retained for seven years by default. The sealed document itself is exportable at any time, and verification does not depend on our servers — a retained export remains verifiable independently."
   • Weak: "We retain records in accordance with our data policy. Customers can contact support to discuss extended retention options."

These are not hostile questions. They are the questions that will be asked if a finding is challenged.

---

Authmarks is designed around these requirements: writing is captured during the session, sealed with a cryptographic hash at submission, and verifiable by any party independently of the Authmarks platform. The verify page demonstrates independent verification — you can check a sealed record without an Authmarks account, which is the test of whether vendor-independence actually holds.

Related reading:

• Tamper-evident vs. tamper-proof: what actually protects a writing record
• Chain of custody for digital writing evidence
• Process data in integrity cases
• How to read a process record
• Investigating an AI-writing concern: a framework for integrity officers
• Verify a sealed record