Hash value (digest)
Definition
A fixed-length output produced by a cryptographic algorithm such as SHA-256 applied to a data set. Any change to the input data, however small, produces a different digest. Used to verify that a forensic copy is identical to the original.
Related terms
- ACPO principles
- Four principles for digital evidence handling published by the UK's Association of Chief Police Officers (now maintained by the Forensic Science Regulator):...
- Chain of custody log
- The continuous record documenting every person who accessed a digital exhibit, every transfer of possession, every examination action, and the hash values...
- Forensic image
- A bit-for-bit verified copy of a storage medium, created using a write-blocker to prevent modification of the original. The copy is verified...
- Working copy
- A copy of an exhibit on which examination work is performed, created from a verified forensic image. The original or master copy...
- Write blocker
- A hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching...
Explained in
- Chain of Custody for Digital MediaA fixed-length output produced by a cryptographic algorithm such as SHA-256 applied to a data set. Any change to the input data, however small, produces a diff...