Use File Checksums to Verify a Research Handoff

Define the file you intend to preserve

A filename and modification date do not uniquely identify a dataset. Two files can share a name while containing different bytes, and a copied file can acquire a different timestamp without changing its content. A cryptographic checksum gives a reproducible digest of the file's bytes for comparison.

Use an established algorithm such as SHA-256 and record its name alongside the digest. The official Python hashlib documentation describes supported hashing algorithms and file-digest operations. A checksum is an integrity aid; it does not explain what a dataset means or establish that its contents are accurate.

Build a small handoff manifest

For each delivered file, record its relative path, byte size, SHA-256 digest, dataset or document version, and purpose. Generate the digest from the completed file after export, rather than from an earlier working copy. Keep the manifest with the handoff record and retain a trusted copy separately when provenance matters.

Include scripts, dictionaries, and relevant supporting files as well as the dataset. A correct data file can still be misinterpreted if its accompanying dictionary or analysis script belongs to a different version. Make the relationship between these files clear in the manifest.

Test the comparison with a harmless example

Create a fictional text file containing the bytes for abc with no trailing newline. Its SHA-256 digest is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. Adding a newline produces a different digest even though a text editor may make the two files look almost identical.

This illustrates a byte-level comparison, not a semantic comparison. Re-saving a spreadsheet, changing line endings, or reordering rows can change the checksum even when the intended scientific information appears equivalent. Preserve the original delivered file and document any intentional transformation rather than expecting the digest to remain unchanged.

Recheck at the receiving end

Have the recipient compute the same algorithm on the received files and compare the full digests with the trusted manifest. Investigate mismatches before using the data: an interrupted transfer, wrong version, or intentional conversion can each explain a difference. Do not overwrite the expected digest merely to make the discrepancy disappear.

A matching digest is strong evidence of byte identity under the algorithm's assumptions, but it is not encryption, authorization, or proof of a trustworthy author. If an attacker can replace both a file and its unprotected manifest, comparison alone does not authenticate the source. Use the approved transfer and access controls for sensitive material.

Finish by recording the comparison result and any resolved mismatch in the handoff log. Continue ordinary content checks, such as row counts, units, and analysis-population definitions. Checksums complement those reviews by identifying which exact files were checked.

Source checked on 1 November 2026; harmless byte example independently hashed.