# MyCloudVault Backup Verification & Integrity Checks

## Overview

MyCloudVault implements comprehensive backup verification using SHA-256 cryptographic hashing and CRC32 checksums to ensure backup file integrity and detect corruption.

---

## Verification Methods

### 1. SHA-256 Hash
- **Purpose**: Cryptographic verification of file integrity
- **Algorithm**: SHA-256 (256-bit secure hash)
- **Use Case**: Detect any file modifications or corruption
- **Storage**: 64-character hexadecimal string

### 2. CRC32 Checksum
- **Purpose**: Quick integrity check
- **Algorithm**: CRC32 (32-bit cyclic redundancy check)
- **Use Case**: Fast corruption detection
- **Storage**: 8-character hexadecimal string

### 3. File Size
- **Purpose**: Quick validation before full verification
- **Storage**: Bytes (converted to MB in database)

---

## Automatic Verification

### During Upload

All backup uploads automatically generate verification data:

1. **File Upload**: Android device uploads backup file
2. **Hash Generation**: Server calculates SHA-256 hash
3. **Checksum Generation**: Server calculates CRC32 checksum
4. **Database Storage**: Hash, checksum, and size stored with backup record
5. **Verification Flag**: Backup marked as verified with timestamp

**Applies to:**
- Regular uploads (POST /api/backup/upload)
- Encrypted uploads (POST /api/backup/upload-encrypted)

---

## Manual Verification API

### Endpoint: POST /api/backup/verify/:backupId

Verify backup file integrity against stored checksums.

**Query Parameters:**
- `deviceId` (required): Device ID for authorization

**Request:**
```
POST /api/backup/verify/a1b2c3d4e5f6?deviceId=android-123
```

**Response (Success):**
```json
{
  "success": true,
  "verified": true,
  "details": {
    "hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "checksum": "a1b2c3d4",
    "size": 1048576000,
    "hashMatch": true,
    "checksumMatch": true,
    "sizeMatch": true
  }
}
```

**Response (Failure):**
```json
{
  "success": true,
  "verified": false,
  "details": {
    "hash": "different_hash_value",
    "checksum": "different_checksum",
    "size": 1048576000,
    "hashMatch": false,
    "checksumMatch": false,
    "sizeMatch": true
  },
  "error": "Hash mismatch"
}
```

**Error Responses:**
- `400`: Missing parameters or no verification data available
- `403`: Unauthorized - backup belongs to different device
- `404`: Backup not found or file missing
- `500`: Server error during verification

---

## Android Integration

See BACKUP_UPLOAD_API.md and BACKUP_RESTORE_API.md for complete Android implementation examples with verification.

---

## Security Benefits

### 1. Corruption Detection
- Detects bit-level file corruption
- Identifies incomplete uploads
- Catches storage media failures

### 2. Tampering Detection
- SHA-256 prevents malicious modifications
- Any file change invalidates hash
- Ensures backup authenticity

### 3. Transfer Validation
- Verifies complete file transfer
- Detects network transmission errors
- Confirms file integrity after download

---

## Best Practices

### For Android Developers

1. **Always verify before restore**: Check integrity before extracting files
2. **Handle verification failures**: Prompt user to re-download corrupted backups
3. **Show verification status**: Display verification results in UI
4. **Periodic verification**: Re-verify old backups to detect storage degradation
5. **Log verification results**: Track verification history for debugging

---

## API Summary

| Endpoint | Method | Purpose |
|----------|--------|------|
| /api/backup/upload | POST | Upload with auto-verification |
| /api/backup/upload-encrypted | POST | Encrypted upload with auto-verification |
| /api/backup/verify/:backupId | POST | Manual verification check |
