With the digitization of medical information, illegal activities such as medical crimes and insurance fraud through tampering have increased. Medical images are particularly vulnerable due to their nature as soft copies and their transmission over networks. National research institutions such as NIST provide guidelines that define security control elements for managing medical images, primarily out of concern for system vulnerabilities. However, there is still a lack of established or standardized digital forensic methodologies specifically tailored to the medical imaging domain. This study proposes a digital forensic technique for detecting manipulation in medical images. Two widely adopted PACS (Picture Archiving and Communication System) platforms were selected, and a dataset comprising 82 samples across 40 types of tampering scenarios was constructed. Tampering behaviors such as the editing or deletion of DICOM files were categorized, and forensic analysis of DICOM tags and system artifacts enabled identification of the type and origin of changes. An automated detection module was developed and tested on 110 validation cases. The results demonstrated accurate detection in all instances, depending on whether the changes were reflected in the actual DICOM files. This research marks the first digital forensic approach to medical image tampering detection and is expected to serve as a foundation for future investigative techniques in response to medical-related crimes.