MD5
Definition
A 128-bit hash algorithm widely used in legacy forensic systems; known collision vulnerabilities (Wang and Yu, 2004) mean SHA-256 or SHA-3 are preferred for new forensic acquisitions.
- Hash length
- 128-bit
- Known weakness
- Collision vulnerability, Wang and Yu, 2004
- Legacy use
- Older forensic imaging systems
- Preferred alternatives
- SHA-256, SHA-3
Common questions
Does the collision vulnerability mean MD5 hash values in old cases are unreliable?+
For verifying accidental corruption or confirming an image matches a source drive, MD5 still works in practice, but its vulnerability to deliberately crafted collisions means it should not be relied on where an adversary could try to forge a matching hash.
Why do courts sometimes still accept MD5 alongside a stronger hash?+
Many legacy forensic tools and case records were generated using MD5 before SHA-256 became standard, so examiners often report both the original MD5 for continuity with earlier documentation and a current SHA-256 value to meet modern integrity expectations.
Related terms
- BSA 2023 § 63
- The electronic record admissibility provision (replacing IEA § 65B), requiring a certificate from a person in a responsible official position confirming the...
- Daubert Standard
- The US federal evidentiary standard (Daubert v. Merrell Dow Pharmaceuticals, 1993) requiring that expert testimony be based on scientifically valid methods with...
- DNG (Digital Negative)
- Adobe's open-standard RAW format providing a vendor-neutral archival container for camera sensor data; accepted as an archival format by SWGDE and several...
- EXIF (Exchangeable Image File Format)
- A metadata standard embedded in JPEG and TIFF files by capture devices. EXIF fields record camera make and model, lens data, exposure...
- Image Enhancement
- Processing of a digital image to improve the visibility of features already present in the original data; permitted under SWGIT, FBI, and...
- JPEG Compression
- A lossy codec that divides an image into 8×8 pixel blocks, applies the discrete cosine transform, quantises the coefficients, and entropy-codes the...
- R V. Tobi (2019)
- UK Court of Appeal decision affirming that forensic image enhancement is permissible provided the original is preserved, the enhancement steps are documented,...
- RAW File Format
- The unprocessed output of a digital camera sensor, stored before demosaicing, white balance, or tonal curve application. Preserves full bit-depth and all...
- SHA-256
- A Secure Hash Algorithm 2 variant producing a 256-bit hash; the current recommended standard for forensic digital evidence integrity verification under SWGDE,...
- SWGDE
- Scientific Working Group for Digital Evidence. A US multi-agency body that publishes consensus best-practice documents for digital forensic disciplines, including image authentication,...
- Write-Once Media
- Optical or other media (DVD-R, BD-R) that physically prevents modification after initial recording; the preferred first-write medium for forensic digital images as...