 Karen Kent

Karen Kent is the first-listed author of the 2006 Guide to Integrating Forensic Techniques into Incident Response by Karen Kent and others. The guide connects digital forensics to investigating computer security incidents and operational faults, separating collection, examination, analysis and reporting.^[ref]

A technical distinction in that workflow is preserving data integrity while separately evaluating what collected data establishes. The guide describes comparing message digests of original and copied data.^[ref]

For an original counterexample, suppose two computer files contain the same two bytes, with hexadecimal values $41$ and $42$, but their recorded paths and creation times differ. A deterministic cryptographic hash function applied only to those content bytes returns the same value for both. That comparison does not establish equality of their file metadata, identify who created either file, or prove when an event occurred. The input being hashed determines what the comparison can support.

Thus integrity checks support the analysis rather than replacing it. This example is about the logical scope of a content hash, not an incident or experimental result reported by Kent.