Hash Value (Digest)
Definition
A fixed-length output produced by a cryptographic algorithm such as SHA-256 applied to a data set. Any change to the input data, however small, produces a different digest. Used to verify that a forensic copy is identical to the original.
- Common algorithm
- SHA-256
- Output
- Fixed-length regardless of input size
- Sensitivity
- Any input change alters the digest
- Forensic use
- Verifying a forensic copy matches the original
Common questions
How is a hash digest actually used during forensic imaging?+
A digest is computed on the source media before copying and again on the completed forensic image, and the two are compared to confirm the acquisition captured the data without alteration.
Does a matching digest prove the original evidence was never tampered with before acquisition?+
No, it only proves the image matches whatever state the source was in at the moment of hashing, so chain of custody documentation for the period before acquisition is still needed to establish integrity from the point of seizure.
Why has SHA-256 largely replaced MD5 for this purpose?+
MD5 has known practical collision attacks that let two different files produce the same digest, undermining its reliability as a tamper check, while SHA-256 has no such practical collision method and is widely accepted by courts.
Related terms
- ACPO Principles
- Four principles for digital evidence handling published by the UK's Association of Chief Police Officers (now maintained by the Forensic Science Regulator):...
- Chain of Custody Log
- The continuous record documenting every person who accessed a digital exhibit, every transfer of possession, every examination action, and the hash values...
- Forensic Image
- A bit-for-bit verified copy of a storage medium, created using a write-blocker to prevent modification of the original. The copy is verified...
- Working Copy
- A copy of an exhibit on which examination work is performed, created from a verified forensic image. The original or master copy...
- Write Blocker
- A hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching...