Hash values and evidence integrity

A forensic copy is only useful if anyone can check that it is identical to what was acquired and has not changed since. Cryptographic hash values make that check fast and objective. This lesson explains hash functions, the algorithms examiners use, what a matching hash does and does not prove, and how known hash values speed up an examination. Recording hash values in chain of custody records is covered in Module 5.

What a hash function does

A cryptographic hash function reads any amount of data, from one word to a whole disk, and produces a short, fixed-length result called a hash value or digest. Four properties make it useful for evidence:

• Fixed length: SHA-256 always returns 256 bits, written as 64 hexadecimal characters, whatever the size of the input.
• Deterministic: the same input always gives the same value, on any computer and with any correct implementation.
• Avalanche effect: changing a single bit of the input changes about half of the output bits, unpredictably.
• One-way and collision resistant: it is not feasible to work back to the input, or to find two inputs with the same value.

For example, the ASCII text "Total due: 1,500.00" has a SHA-256 value beginning 6b2c7c4a. Change the 5 to a 4, which alters exactly one bit, and the value begins efdbbff7, with nothing hinting that the inputs are almost identical.

Common algorithms

A collision is two different inputs with the same hash value. For MD5 and SHA-1, such pairs can now be created deliberately, so both are considered broken for security uses such as digital signatures, and neither should be the only hash recorded for evidence. The attacks craft two new inputs together; they do not produce a file matching the hash of an existing one, so an old MD5-verified image is not suddenly unreliable. Current practice is SHA-256 or stronger, often recorded together with MD5 or SHA-1 because older tools, reports and hash databases may list only those values.

Acquisition hash and verification hash

Two hash values form the basic integrity check.

• The acquisition hash is computed by the imaging tool from the data as it reads it from the source. It describes the source as it was at the time of acquisition.
• The verification hash is computed afterwards by reading the image or copy back and hashing it again. If it equals the acquisition hash, the copy is a faithful record of what was read.

The comparison can be repeated at any time: before analysis, when a copy is handed over, or in court. After a dead-box acquisition the source can also be hashed again to show it was not altered. A mismatch must be investigated and explained, never ignored; common causes are a failing drive that reads inconsistently, a copying error, or a write that got past the write blocker.

Whole images and individual files

An image hash covers the entire stream of acquired data. A file hash covers the content of a single file.

A file hash does not include the file's name, path or timestamps, which the file system stores separately. Two files with identical content but different names share a hash. File hashes are ideal for finding duplicates and showing that an exported file matches the one inside the image, but say nothing about when or where a copy was made.

The image hash does not depend on the format: raw and E01 images (Lesson 4.3) of the same drive give the same image hash.

What a hash proves and what it does not

A matching hash is strong, objective evidence, but of a narrow fact.

• It proves that the copy is bit-for-bit identical to the data that was hashed, and that it has not changed since.
• It does not prove that the source was unchanged before acquisition. If someone altered a drive the day before it was seized, the image faithfully preserves the altered drive.
• It does not prove who created, sent or modified the data, or when. Those questions are answered by analysis (Module 6).
• It does not prove that the acquisition was complete. A targeted copy can be perfectly verified and still leave out what matters.
• It is only as safe as its record. Someone able to change an image could also change a hash value stored only next to it, so record the values in notes and chain of custody records as well (Module 5).

Hash sets: recognizing known files

A hash set is a list of hash values for files whose identity is already known, so matching files are recognized without anyone opening them.

• Known files: the National Software Reference Library (NSRL), run by NIST, publishes hash values for files from commercially available software, so operating system and application files can be filtered out of a review. NIST calls these files known, not good: the set includes software, such as hacking tools, that may itself be relevant.
• Known bad or notable files: lists of malware or illegal material flag matching files automatically and spare examiners from viewing known illegal images again.

Hash matching finds only identical files: a resized photo has a different value. Fuzzy and perceptual hashing indicate likeness rather than identity, and their results need review.

A worked example

Ana, an examiner at a fictional laboratory, images a 1 TB drive. The values below are shortened and illustrative.

1. The tool reports the acquisition hash: SHA-256 4e1a…9c07 and MD5 b3d2…51fa. Ana records both.
2. Verification reads the image back and reports the same values.
3. Two weeks later, before analysis, her working copy still gives 4e1a…9c07.
4. A colleague hashes a second copy with a different tool and gets the same SHA-256 value, which also shows reproducibility (Module 1).
5. Ana exports one spreadsheet and records its file hash, so anyone can confirm it matches the file in the image.

Had any value differed, Ana would have recorded the discrepancy and found its cause before relying on the copy.

Exam focus: Know the properties of a hash function (fixed length, deterministic, avalanche effect, one-way, collision resistant) and the sizes of MD5 (128 bits), SHA-1 (160 bits) and SHA-256 (256 bits). Know why SHA-256 is preferred and MD5 or SHA-1 still recorded alongside it. Tell acquisition from verification hash, and image hash from file hash. Expect scenarios on what a matching hash does and does not prove, and on hash sets such as the NSRL.