Hash Value
Definition
A fixed-length digital fingerprint produced by running a file through a cryptographic algorithm such as SHA-256 or MD5. Identical files produce identical hashes; any alteration produces a different hash. Used at acquisition and at every subsequent stage to verify file integrity.
- Type
- Fixed-length cryptographic fingerprint of file content
- Common algorithms
- SHA-256, SHA-1, MD5
- Purpose
- Verifies file integrity and detects tampering in evidence chain of custody
- Key property
- Any change to the underlying data produces a completely different hash
Common questions
What makes a hash value proof that a file wasn't changed?+
A hash value is a fingerprint of a file's content. Even a tiny change to the file produces a completely different hash. If you compute a hash before and after handling evidence and get the same result, you know the file's binary content is identical. Different hashes mean the file was altered somewhere along the chain of custody.
Which algorithms are used to create hash values in forensics?+
The most common are SHA-256, SHA-1, and MD5. All three produce a fixed-length string from any file or dataset. SHA-256 is widely preferred today because it is more secure than MD5 and SHA-1.
When do forensic teams compute a hash value?+
Hash values are computed at acquisition (when the evidence is first imaged or copied) and then verified again at every subsequent stage. If the hash matches at each step, you have proof the evidence has not been tampered with.
Related terms
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Write Blocker
- A hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching...
- Audit Trail
- A log maintained by an accounting system, ERP, or cloud application recording who accessed, created, modified, or deleted each record, with timestamps....
- Bit-Stream Image
- Sector-by-sector exact copy of a storage medium, including unallocated and slack space. Created with dd, FTK Imager, EnCase or X-Ways. Output formats:...
- BSA 2023 Section 63 Certificate
- Mandatory certificate accompanying any electronic record produced as secondary evidence in Indian court. Replaces IEA Section 65B from 1 July 2024. Signed...
- Budapest Convention
- The Council of Europe Convention on Cybercrime (2001), the first binding international treaty on cyber offences. Requires signatory states to criminalise illegal...
- Computer Forensics
- Application of investigative and analytical techniques to identify, preserve, acquire, examine and present digital evidence in a legally defensible manner. Five-stage pipeline:...
- Computer Fraud and Abuse Act (CFAA)
- 18 U.S.C. § 1030, the primary US federal computer crime statute. Criminalises unauthorised access to protected computers, data theft, system damage, and...
- Computer Misuse Act 1990 (CMA)
- The primary UK statute creating offences of unauthorised access to computer material, unauthorised access with intent to commit further offences, and unauthorised...
- Continuity Witness
- The person who can testify to each transfer of the exhibit, from collector to analyst to storage to court. Every transfer must...
- Custodian
- In e-discovery, a person who possesses, controls, or has responsibility for documents or electronic records relevant to an investigation. Identifying custodians is...
- Daubert Standard
- The US federal evidentiary standard (Daubert v. Merrell Dow Pharmaceuticals, 1993) requiring that expert testimony be based on scientifically valid methods with...
Explained in these topics
- Chain of Custody for Media EvidenceA fixed-length digital fingerprint produced by running a file through a cryptographic algorithm such as SHA-256 or MD5. Identical files produce identical hashe...
- Computer Forensics: Cyber Crimes, Digital Evidence, Seizure and AcquisitionFixed-length fingerprint of a file or image computed with MD5, SHA-1 or SHA-256. Matching hash before and after imaging proves the copy is identical to the ori...
- Cyber Investigation Reporting and Court PresentationA fixed-length cryptographic digest (typically MD5 or SHA-256) of a digital file or disk image. If two hash values match, the underlying data is identical. A m...
- Digital Evidence in Financial CasesA fixed-length cryptographic fingerprint of a file computed by an algorithm such as MD5, SHA-1, or SHA-256. Matching hash values before and after any transfer...
- Electronic Evidence and the Authentication CertificateA fixed-length string generated by a cryptographic algorithm (such as SHA-256 or MD5) applied to a digital file. Identical files always produce the same hash;...
- Electronic Evidence Statutes and Cyber OffencesA fixed-length digest produced by a cryptographic algorithm (typically SHA-256 or MD5) applied to a dataset. In digital forensics, matching hash values between...
- Evidence Collection and Chain of CustodyA fixed-length string generated from a file or dataset by a cryptographic algorithm (typically SHA-256 or MD5). Any change to the underlying data produces a co...