Define what was hashed
Record the algorithm, value and exact object: an export archive, mailbox file, individual message or extracted attachment. Retain the source package and derived files separately. A hash of an archive is not interchangeable with hashes of its contents. Repeating a calculation is meaningful only when the objects and method are clear.
Document the handling
Record the source, custodian, collection method, date, scope, transfers and relevant processing. Explain transformations, errors and known omissions. Working copies should remain distinguishable from supplied originals. A technically valid digest cannot repair an undocumented source history or establish that a supplied file was authentic before collection.
Interpret matching and differing values
Matching values using an appropriate cryptographic method support consistency of the compared bytes. Different values show a byte difference, which may arise from conversion, metadata or substantive content. Investigate that difference rather than labelling it tampering automatically. Two message representations can convey the same visible text while having different hashes. The final opinion should connect integrity checks with provenance and independent corroboration instead of treating one checksum as the entire authenticity assessment.
Sources & further reading
Primary references support the technical explanation. They do not establish D3 validation of a particular method.