Hash values and forensic images
A plain-language explanation for lawyers, HR and managers of what a hash value is, how a forensic image differs from a copy, and how to read the hash references in a forensic report.
Reviewed by the ITRS security team · Last updated
What a hash value is
A hash value is a fixed-length string of characters calculated from a file or a whole disk by a mathematical function called a hash algorithm. Think of it as a fingerprint for data. The same data always produces the same hash value; change even one character, and the hash value changes completely and unpredictably.
That property makes hashes the standard way to prove digital evidence has not changed. If a laptop's drive is hashed when it is imaged, and the image produces the same value months later, the image is identical to what was collected. ISO/IEC 27037 and NIST SP 800-86 both rely on this kind of integrity verification.
| Algorithm | Length (hex characters) | Example of format |
|---|---|---|
MD5 | 32 | 9e107d9d372bb6826bd81d3542a419d6 |
SHA-1 | 40 | 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12 |
SHA-256 | 64 | d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592 |
Forensic image versus copy
Copying files from a computer, by dragging them to a USB drive for example, captures the files' content but not the rest of the disk, and can change file dates on the way. A forensic image is a bit-for-bit copy of an entire storage device (or a defined part of it), usually made through a write-blocker so the original cannot be altered. It includes deleted files, unallocated space, file system records and system artifacts that an ordinary copy leaves behind.
Not every matter needs a full image. A targeted logical collection of specific folders, or an eDiscovery export from Microsoft 365 or Google Vault, may be proportionate. What matters is that whatever is collected is hashed and documented.
| Item | Ordinary copy | Logical collection | Forensic image |
|---|---|---|---|
Captures deleted data | No | Generally no | Often, depending on the device |
Preserves file system metadata | Partially, can alter dates | Yes, with proper tools | Yes |
Hash verified | Rarely | Yes | Yes |
Typical use | Day-to-day work | Targeted eDiscovery | Investigations, disputes over deletion or activity |
Verification at each step
At acquisition
The imaging tool calculates the hash of the source as it reads, and of the image it writes. The two should match.
On transfer
When evidence moves between people or storage, the hash is recalculated and recorded on the chain-of-custody log.
Before analysis
The examiner verifies the working copy against the acquisition hash before starting.
At production
Exported items and reports can be accompanied by hash values so the recipient can verify what they received.
Algorithms and collisions in practice
A 'collision' is when two different inputs produce the same hash value. Researchers have shown that collisions can be deliberately constructed for MD5 and SHA-1, which is why they are no longer used for security purposes like digital signatures. SHA-256 has no known practical collisions.
For evidence integrity the practical risk is very low: a collision would have to be engineered for the specific evidence, in advance, without leaving other traces. Still, current practice is to use SHA-256, often alongside MD5 for compatibility with older tools and records. If you see MD5 alone in an older report, it is not a reason to doubt the evidence by itself, but it is a fair question to ask.
Reading hash references in a report
- Each evidence item should list its algorithm and value at acquisition
- Verification entries should show the same value, with dates
- A mismatch is significant and should be explained in the report (for example, an imaging error that was re-done)
- Hashes of individual files can show that a produced document is identical to the one found on a device
- Known-file hash lists can identify common software or flagged files without opening them
FAQ
No. A hash only shows whether data is identical to other data. Dates and authorship come from metadata and system artifacts.
Yes. Windows (Get-FileHash in PowerShell) and macOS (shasum in Terminal) can calculate SHA-256 values for a file.
No. A file's hash is calculated from its content, not its name, so a renamed but otherwise identical file has the same hash.
Related.
- HubCyber, forensics, privacy and legal-tech glossaryPlain-English definitions of the terms used across this site, from BEC and chain of custody to RROSH, DMARC and legal holds, with links to the pages that go deeper.
- GlossaryChain of custody (digital evidence)The documented record of who collected, held, transferred and examined an item of digital evidence, from the moment it was identified to the moment it is presented or…
- ServiceDigital forensics in Toronto: computers, phones, Microsoft 365 and Google WorkspaceIT Rapid Support provides digital and computer forensics services for businesses in Toronto, the GTA and Ontario, focused on Microsoft 365, Exchange Online and Google…
- ServiceDocument and metadata authenticity analysisWhen a Word document, PDF or image may have been backdated or altered, metadata, version history and system artifacts can often show when and how it was really created.
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.