Cryptographic Hash (MD5/SHA-256)
Definition
A fixed-length digest computed from the contents of a file or disk image. Used to verify that a forensic copy is identical to the source: if both hashes match, the copy has not been altered. SHA-256 is the current standard; MD5 is still reported for legacy compatibility but should not be used alone.
- Output
- Fixed-length digest of a file or disk image
- Current standard
- SHA-256
- Legacy algorithm
- MD5, not recommended alone
- Forensic use
- Verifying a forensic copy matches the source
Common questions
Why is MD5 still reported at all if it should not be relied on alone?+
MD5 has known collision weaknesses that mean two different inputs can in principle produce the same hash, but it remains widely used in legacy tools and reports, so examiners often record it alongside SHA-256 for continuity and compatibility with older case records rather than as the sole integrity check.
What does a matching hash actually prove, and what does it not prove?+
A matching hash confirms the copy is bit-for-bit identical to the source at the moment the hash was taken. It says nothing about whether the source itself was already altered before that hash was computed, which is why chain of custody and acquisition procedure matter just as much as the hash itself.
Related terms
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Forensic Image
- A bit-for-bit verified copy of a storage medium, created using a write-blocker to prevent modification of the original. The copy is verified...
- Legal Hold
- A directive from legal counsel instructing relevant people within an organisation to preserve documents, data, and physical items that may be relevant...
- Order of Volatility
- The sequence in which digital evidence should be collected, ranked from most to least transient. Defined in RFC 3227. CPU registers and...
- Write Blocker
- A hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching...