A matching hash does not identify the human actor

A fictional authorized investigation preserves a storage image and records matching integrity hashes for the acquired and working copies. A supplied log contains a source network address and an account name, but the environment also has shared accounts, an intermediary gateway and uncertain clock alignment. A colleague proposes naming a particular person as the actor because the image hashes match. Another separates byte-integrity comparison from attribution and asks for corroborating identity, access and time evidence. This written case acquires no device and accesses no private log. It asks what the matching values support, what they do not prove and how the report should preserve both handling accountability and uncertainty about the person responsible.