Tamper-evidence is a property of a file, device, or process that makes unauthorized changes visible or detectable. It does not always stop an attacker from modifying data; instead, it helps defenders notice that something has been altered and should no longer be trusted.
In cyber security, tamper-evidence is critical for logs, firmware, forensic evidence, and other data that must remain trustworthy after collection. Common controls include digital signatures, checksums, hashes, audit trails, and sealed containers. If an attacker edits a file, injects malicious content, or replaces evidence in transit, these controls can reveal the change during verification. In real defenses, tamper-evidence supports chain of custody, incident response, and compliance by giving analysts a way to prove whether data is original or has been modified. It is especially valuable in workflows where even small changes can affect decisions, reports, or automated analysis.