I've had a client come to me with a request for a feature to prove that a file uploaded to a cloud service we run is the same as the one that they subsequently stored in their document management system. They would need to do this well after the originally uploaded file was deleted. They would need to provide this proof as evidence during legal proceedings.
My knee-jerk reaction is to implement a feature to md5 hash the file on upload to the cloud service and store the result as an audit record. This would allow for later comparison with a hash of the file from their document management system.
I'm also wondering whether basic (non-computed) metadata about the file and then compare that to the downloaded file could be enough - filename, file size etc.
This is really a digital forensics question. Does anyone have any experience in this area? How strong does the proof need to be? What could we implement to prove that the two files are the same under the assumption that one would be deleted? Any sources of guidance would be amazing.