Hash Verification
Definition
The process of computing a cryptographic hash (SHA-256 or equivalent) of the exhibit file and comparing it against a previously recorded value to confirm the file has not been altered since acquisition. Hash values must be logged at intake and again at the time of examination. Any mismatch is a chain-of-custody failure that must be disclosed.
- Common algorithms
- MD5 and SHA-256
- Detection capability
- Single byte changes produce different hashes
- Primary use
- Proving digital images are exact copies of originals
Common questions
What does it mean when two hashes match?+
If the hashes are identical, the file is bit-for-bit identical to the original at the time the reference hash was recorded. Even a single byte of change will produce a different hash, making this a reliable way to confirm a file has not been altered.
Why use both MD5 and SHA-256 instead of just one?+
Using both in parallel is the dual-hash standard for digital evidence. This redundancy strengthens the verification and provides independent confirmation that the image is an exact copy of the source.
How does hash verification fit into digital evidence collection?+
It's used as cryptographic fingerprinting during imaging to prove the digital image is an exact copy of the source. Computing the hash as the image is created and comparing it to a reference value establishes the integrity of the evidence from seizure through storage.
Related terms
- Bitrate Anomaly
- A departure from the expected relationship between scene complexity and compressed file size. Sudden drops, plateaux, or spikes in the per-second bitrate...
- C2PA (Coalition for Content Provenance and Authenticity)
- An open technical standard that embeds cryptographically signed provenance assertions into media files at the point of capture or editing. A C2PA...
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Daubert / Frye Split
- Two competing standards for expert testimony admissibility in the US. Daubert (1993) uses a multi-factor reliability test applied by the trial judge....
- Daubert Standard
- The US federal evidentiary standard (Daubert v. Merrell Dow Pharmaceuticals, 1993) requiring that expert testimony be based on scientifically valid methods with...
- Deepfake Detector
- A machine-learning classifier trained to distinguish authentic recordings from AI-synthesised or face-swapped media. Outputs a probability score rather than a binary verdict....
- Double Compression
- The condition in which a video has been encoded at least twice through a lossy codec. The term is also used loosely...
- Error Level Analysis (ELA)
- A technique that re-compresses a JPEG at a controlled quality setting and maps the pixel-level difference between the re-compressed and original images....
- Examination Scope
- The defined boundaries of a forensic examination: what evidence was examined, what questions were asked, what time periods were covered, and what...
- Expert Witness
- A person whose specialised knowledge is accepted by a court and who gives opinion evidence, not just factual evidence. Forensic auditors frequently...
- False-Positive Rate
- The proportion of authentic media files that a detection tool incorrectly classifies as manipulated or synthetic. Deepfake detectors and ELA tools both...
- Faraday Bag
- A signal-blocking pouch with conductive mesh lining that prevents cellular, Wi-Fi, Bluetooth and NFC signals from reaching a seized phone. The standard...
Explained in these topics
- The Digital First Responder: Order of Volatility, Seizure and ImagingCryptographic fingerprinting of the source and the image to prove the image is an exact copy. MD5 and SHA-256 are computed in parallel as the dual-hash standar...
- Forensic Reporting and Expert Testimony in Mobile and Network CasesThe process of computing a cryptographic hash (typically MD5 or SHA-256) of a digital evidence file and comparing it to the hash computed at the time of acquis...
- Video Authentication and Integrity VerificationCalculating a cryptographic hash (MD5 or SHA-256) of a file and comparing it to a previously recorded reference value. If the hashes match, the file is bit-for...
- Writing a Media Authenticity Examination ReportThe process of computing a cryptographic hash (SHA-256 or equivalent) of the exhibit file and comparing it against a previously recorded value to confirm the f...