File integrity checks compare a current file, folder, or system image against a trusted baseline to see whether anything has changed unexpectedly. The comparison may use hashes, timestamps, permissions, or known-good copies. If a file has been altered, deleted, or replaced, the check can reveal that mismatch quickly.
These checks matter because attackers often modify executables, web files, scripts, configuration files, or backups to hide persistence, implant malware, or sabotage recovery. In ransomware cases, integrity checks can help defenders spot unauthorized encryption, tampering, or destructive changes before they spread. They are also useful after an incident claim: security teams can verify whether the alleged target was actually changed, and which systems remain trustworthy. Used with logs and backup validation, file integrity checks provide evidence that supports incident response and restores confidence in stored data.