Hash Values: Proving a Copy Is Exact

What you'll be able to do

By the end of this lesson you will be able to use hash values the way forensic examiners do.

• Explain what a hash value is and what a matching hash does and does not prove.
• Describe the three forensic uses of hashes: proving copies identical, finding files, and including or excluding files.
• Calculate the SHA-256 hash of a file on your own computer and explain why SHA-256 is today's default.

What Is a Hash?

The book explains that a hash is a string of numbers and letters produced by a mathematical algorithm to represent the contents of a file. You can hash a single file, an entire drive, or the files in a folder (each file gets its own hash). With a strong algorithm such as SHA-256, if two items produce the same hash, their contents are the same.

Two properties make hashes so useful:

• Fixed length, whatever the input. A SHA-256 hash is always 64 hexadecimal characters, whether you hash one word or a 2-terabyte drive.
• Tiny change, completely different result. The book's sample values show it: changing even one character does not change part of the hash, it produces an entirely different number. Identical content, on the other hand, always gives the identical hash, whatever the file is called.

Here are two standard test values you can check yourself. The three letters abc, with nothing else, hash as follows:

MD5      900150983cd24fb0d6963f7d28e17f72
SHA-256  ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

Use 1: Proving a Copy Is Exact

The most important forensic use is the one you met in Lesson 1.4. The examiner hashes the original drive, makes the copy, then hashes the copy. If the hashes match, the copy is identical. That pair of values is recorded and can be recalculated by anyone, at any time, to show nothing has changed.

The book adds a practical warning. Hash values should always match; if they do not, you must either try again or be able to explain why. One common reason is hashing a running system: even if nobody touches it, background processes such as the clock keep changing data, so two hashes of a live drive will differ.

Use 2: Finding a File, Whatever Its Name

Because a hash covers the contents and not the name, it can find a file however it has been disguised. Suppose a USB stick holds a confidential file, and you need to know whether it was ever on a particular PC. Even if the suspect renamed it, changed its extension and hid it in a system folder, a search by hash value will find it.

Use 3: Including and Excluding Files

A large drive holds hundreds of thousands of files, most of them ordinary operating-system and program files. Hashes let examiners narrow the search:

• Exclude the known-good. If the hashes of standard system files match the values they had when the software shipped, those files can be set aside. NIST's National Software Reference Library publishes hash values of known software for this purpose. A match means "known", not automatically "harmless": the set includes some hacking tools, so use it to set aside ordinary system and program files.
• Include the known-bad. Hash lists exist for particular malware and for known illegal images. Searching only for matches finds harmful material without opening every file.

The book points out a further advantage: with a hash list, you do not need the files themselves. Possessing certain files may be harmful or even illegal, but matching against their hash values is safer and easier.

What a Hash Proves, and What It Does Not

Be precise. A matching hash proves the data has not changed since it was hashed. It does not prove who created the files, what happened before the evidence was collected, or that the collection was lawful. Those questions are answered by the chain of custody, the authority for the search and the analysis itself.

Try It: Hash Your Own File (Optional)

On your own computer, create a text file called note.txt containing a short sentence. Then calculate its SHA-256 hash:

• Windows (PowerShell): Get-FileHash .\note.txt (SHA-256 is the default; add -Algorithm SHA256 to be explicit)
• macOS (Terminal): shasum -a 256 note.txt
• Linux (terminal): sha256sum note.txt

Now experiment:

1. Rename the file to holiday.jpg and hash it again. The hash is unchanged, because only the name changed.
2. Change one letter inside the file, save it and hash it again. The hash is completely different.

If you try to reproduce the abc values above, note that many text editors add an invisible line break at the end of a file, which changes the hash. That is a lesson in itself: hashes are exact.

Real-World Example

Imagine (a fictional scenario) an engineering company that believes a departing employee took a confidential design file called turbine_v7.dwg. The examiner calculates its SHA-256 hash from the company's server. On the image of a USB stick the employee handed back, no file has that name, but a hash search finds a file called family_recipes.txt in a hidden folder with exactly the same hash. The name was changed; the contents were not. The examiner reports that a file identical in content to the design file is on the stick, and is careful not to claim, on the hash alone, who put it there or when.

From the Book to 2026

What the book teaches. MD5 (128-bit, 32 hexadecimal digits) is one of the most common hash algorithms. It has been shown in a laboratory to produce collisions (two different files with the same hash), which prompted SHA-1 and SHA-2. The book describes these as stronger algorithms, developed by the US National Security Agency, that have not been shown to produce collisions. MD5, SHA-1 and SHA-256 are the ones seen most often.

Why it made sense. For years SHA-1 was the trusted step up from MD5, and both remain common in forensic tools and older cases.

What has changed. The statement about SHA-1 is out of date. In February 2017, researchers at CWI Amsterdam and Google published the first practical SHA-1 collision (the "SHAttered" project). NIST has announced that SHA-1 should be phased out by 31 December 2030 in favor of SHA-2 or SHA-3. For MD5, the IETF has long advised against relying on it where collision resistance matters. No collision has been shown for SHA-256, part of the SHA-2 family, which is now the sensible default. SWGDE, the US forensic practitioners' group, notes that MD5 and SHA-1 may still be acceptable for some forensic purposes, such as verifying integrity against accidental change or identifying known files. That is why you still see them. One point of history also needs correcting: SHA-1 (1995) and SHA-2 (2001) were published before the first practical MD5 collisions (2004). MD5's weaknesses sped up the move to them; they did not prompt their creation.

What to do now. Record SHA-256 for every acquisition. Many tools can record MD5 or SHA-1 alongside it for compatibility. Treat MD5 and SHA-1 as legacy algorithms, and never rely on them alone where someone might deliberately try to forge a match.

Watch: Hashing Algorithms and Security

In this Computerphile video, Tom Scott explains what hashing algorithms are for and why the algorithms people trust keep changing. It was published in 2013, before the first practical SHA-1 collision, so it is also a useful snapshot of how the field has moved since.

Questions to keep in mind as you watch:

• Why does a good hash function produce a completely different output after a tiny change to the input?
• Why can an algorithm that is trusted for years suddenly need replacing?
• How do the ideas in the video connect with this lesson's From the Book to 2026 section?

The video complements what you just read. The lesson is complete without it.

What Would You Do?

You imaged a suspect's USB stick through a write-blocker and recorded its SHA-256 hash. A colleague re-hashes the image file a week later and gets a different value. Before panicking, what would you check, and what would you write in your notes? Decide, then compare with the model answer in the note below.

Knowledge Check

Key Takeaways

• A hash is a fixed-length value calculated from contents. Identical contents give identical hashes, and any change gives a completely different hash.
• Forensic uses: prove a copy is exact, find renamed files, and include or exclude files with hash lists.
• A matching hash proves no change since hashing, and nothing about who, when or whether collection was lawful.
• SHA-256 is today's default. MD5 and SHA-1 are legacy, after practical collisions and NIST's retirement of SHA-1.

Sources

• Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapter 2.2
• NIST — FIPS 180-4: Secure Hash Standard
• CWI Amsterdam and Google — SHAttered: the first SHA-1 collision (2017)
• NIST — NIST Retires SHA-1 Cryptographic Algorithm (December 2022)
• IETF — RFC 6151: Updated Security Considerations for the MD5 Message-Digest and the HMAC-MD5 Algorithms
• SWGDE — Position on the Use of MD5 and SHA1 Hash Algorithms in Digital and Multimedia Forensics
• NIST — National Software Reference Library (NSRL)
• Microsoft Learn — Get-FileHash
• man7.org — sha256sum(1)