Whenever digital evidence is discussed, a long string of letters and numbers eventually appears: the hash value. It is the tool used to prove that a file, a disk image or an archive has not changed by a single bit since it was acquired. Understanding how it works helps you use it properly and explain it to whoever has to assess the evidence.
What a hash function is
A cryptographic hash function takes input data of any size, from a single word to a multi-terabyte drive, and returns a fixed-length value. For SHA-256, for example, the result is always 256 bits, represented as 64 hexadecimal characters.
Three properties make it useful:
- determinism: the same data always produces the same hash, on any computer and with any program that correctly implements the algorithm;
- avalanche effect: a minimal change, even one bit, produces a completely different hash;
- collision resistance: it must be practically impossible to find two different data sets with the same hash.
Thanks to these properties the hash works like a fingerprint: it does not let you rebuild the data, but it lets you recognise it with certainty.
A concrete example
Suppose you acquire a USB stick and calculate its SHA-256. You write the value in the record. Six months later, the other side's expert receives a copy of the image and recalculates the hash with a different program. If they get the same value, you are both working on exactly the same data. If the value differs, something has changed, and you need to find out what.
Adding a single space to a text document is enough to change the fingerprint entirely. There are no "almost matching" hashes: they either match or they do not.
Which algorithms to use
Not all hash functions offer the same guarantees today.
| Algorithm | Length | Current status |
|---|---|---|
| MD5 | 128 bits | Practical collisions known; do not use alone |
| SHA-1 | 160 bits | Collisions demonstrated; discouraged |
| SHA-256 | 256 bits | Considered secure, the standard choice |
| SHA-512 | 512 bits | Considered secure, useful for large volumes |
| SHA-3 | variable | Modern alternative, less common in tools |
For MD5 and SHA-1, techniques are known for deliberately building two different files with the same fingerprint. In everyday forensic practice this does not mean every MD5 hash is unreliable, but it gives the other side an easy argument. The simplest solution is to calculate SHA-256 as the main reference; many professionals add a second algorithm too, for a double check.
How to calculate it
Almost every operating system lets you calculate a hash without installing anything:
- on Windows, from PowerShell, with the Get-FileHash command;
- on macOS, with the shasum command in Terminal;
- on Linux, with sha256sum.
Forensic acquisition tools calculate the fingerprint automatically during copying and include it in the final report. It is still worth verifying it with a second, independent program to rule out errors in a single tool.
Where hashes are used in digital forensics
- acquisition verification: comparing the hash of the original with that of the copy;
- periodic checks: recalculating the hash before each analysis and before delivery;
- file lists: producing a list with the fingerprint of each delivered file, so every item can be checked individually;
- known-file searches: comparing hashes against databases of known files, to exclude harmless system files or spot files already identified;
- deduplication: removing duplicates from large document collections.
Common mistakes
- Hashing too late: a fingerprint calculated weeks after acquisition only proves the file has not changed since then.
- Keeping the hash only next to the file: anyone who alters the file can also alter the text file holding its fingerprint. The hash belongs in the signed record, delivered separately.
- Confusing file hash and container hash: the hash of a compressed archive does not match the hashes of the files inside it.
- Believing the hash proves authenticity: the fingerprint shows the data has not changed since it was calculated, not that it was genuine or complete before.
That last point is the most misunderstood. If a chat was manipulated before acquisition, the hash of the manipulated chat will be perfectly stable. Integrity is one thing, authenticity another, and it requires different analyses.
In short
- A hash is a fixed-length fingerprint that changes completely with any minimal change.
- SHA-256 is today's standard choice; MD5 and SHA-1 should not be used alone.
- The fingerprint must be calculated immediately and written in the record, not just saved next to the file.
- Providing the hash of every delivered file allows independent verification.
- A hash proves integrity from the moment of calculation, not earlier authenticity.