Introduction
Cryptographic hash functions such as MD5 and the SHA family are fundamental to digital forensics, incident response, malware analysis, and evidence handling.
A file hash is a mathematically generated value derived from the contents of a file. Even a single-bit alteration in a file produces a completely different hash value.
Hash analysis allows investigators to:
- Verify evidence integrity.
- Identify known files.
- Detect modified files.
- Identify malware.
- Eliminate benign operating system files.
- Compare evidence across investigations.
- Validate forensic images.
Hashing is one of the most important techniques used during forensic examinations because it provides a digital fingerprint of a file.
What is a Hash Function?
A hash function is a mathematical algorithm that converts input data of any size into a fixed-length output known as a hash value, digest, or checksum.
For example:
File: report.docx
MD5: 8d777f385d3dfec8815d20f7496026dc
SHA-1: a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA-256: 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
The same file always produces the same hash.
Changing even a single byte results in a completely different hash.
Properties of Cryptographic Hash Functions
A forensic hash function should possess:
Deterministic
Identical input always produces identical output.
Fast Computation
Hashes can be calculated quickly, even on large files.
Avalanche Effect
Small changes produce completely different outputs.
One-Way Function
The original file cannot be reconstructed from the hash.
Collision Resistance
Two different files should not generate the same hash.
MD5 (Message Digest Algorithm 5)
MD5 was developed in 1991 by Ron Rivest
Characteristics
Property Value
Output Length 128 bits
Display Length 32 hexadecimal characters
Block Size 512 bits
Year Released 1991
Example:
MD5: d41d8cd98f00b204e9800998ecf8427e
How MD5 Works
The algorithm:
- Pads the message.
- Divides data into 512-bit blocks.
- Initializes internal state variables.
- Performs four rounds of mathematical operations.
- Produces a 128-bit digest.
MD5 in Digital Forensics
MD5 remains widely used because:
- Extremely fast.
- Supported by almost all forensic tools.
- Historically used in evidence verification.
- Compatible with large hash databases.
Applications include:
- File identification.
- Evidence validation.
- Known file filtering.
- Malware identification.
MD5 Collision Weakness
Researchers demonstrated that different files can intentionally produce the same MD5 hash.
This is called a collision.
Although practically irrelevant for accidental collisions during forensic examinations, deliberate collision attacks make MD5 unsuitable for security applications.
SHA Family
Secure Hash Algorithms were developed by:
- National Security Agency
- National Institute of Standards and Technology
The SHA family includes:
Algorithm Output Size
SHA-1 160 bits
SHA-224 224 bits
SHA-256 256 bits
SHA-384 384 bits
SHA-512 512 bits
SHA-1
SHA-1 was introduced in 1995.
Example: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
Length: 160 bits.
40 hexadecimal characters.
Like MD5, SHA-1 has known collision vulnerabilities.
Many forensic laboratories have therefore moved away from SHA-1.
SHA-256
SHA-256 is currently the most commonly used forensic hashing algorithm.
Characteristics:
Property Value
Output Length 256 bits
Hex Characters 64
Security Very strong
Collision Attacks None practical
Example: 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA-256 is widely used for:
- Evidence integrity.
- Digital signatures.
- Malware analysis.
- Secure file distribution.
- Chain of custody.
Hashing During Forensic Imaging
When creating a forensic image:
- Original media is hashed.
- The image file is created.
- The image is hashed.
- Both values are compared.
Matching Acquisition and Verifications hash values demonstrate that the forensic image is an exact bit-for-bit copy.
Multiple Hash Algorithms
Many forensic tools calculate both:
- MD5
- SHA-1
- SHA-256
Using multiple algorithms increases confidence and maintains compatibility with historical datasets.
Known File Filtering
Hash analysis enables investigators to compare files against databases.
Examples include:
- Operating system files.
- Application files.
- Malware samples.
- Contraband material databases.
The process:
- Calculate file hashes.
- Compare against known hash sets.
- Categorize files.
Categories:
- Known good.
- Known bad.
- Unknown.
This significantly reduces the number of files requiring manual examination.
Hash Sets in Digital Forensics
Common uses include:
- Known Good Files
- System files that can be ignored.
Examples:
- Windows operating system files.
- Microsoft Office components.
- Browser files.
Known Bad Files
Known malicious files such as:
- Malware.
- Trojans.
- Ransomware.
- Illegal content hashes.
National Software Reference Library
The U.S. government maintains National Software Reference Library
The database contains millions of hashes from legitimate software files.
Investigators can exclude these files from examination.
Hash Databases
Examples:
- NSRL.
- Internal laboratory databases.
- Malware repositories.
- Intelligence databases.
Modern forensic suites can automatically compare millions of hashes within minutes.
Fuzzy Hashing
Traditional hashes require exact matches.
Fuzzy hashing identifies similar files.
Examples:
- ssdeep.
- TLSH.
Applications:
- Malware variants.
- Similar documents.
- Partial files.
- Fragment analysis.
Example:
File A: 85% similarity
File B: 83% similarity
This allows investigators to identify modified versions of known files.
Hashing and Malware Analysis
Malware analysts frequently search using hashes.
Examples:
- MD5
- SHA-1
- SHA-256
Public repositories allow investigators to determine whether a file is known malware.
Common workflow:
- Calculate SHA-256.
- Search malware intelligence databases.
- Review detections.
- Correlate findings.
Limitations of Hash Analysis
Hashing cannot determine:
- Who created a file.
- When a file was created.
- User activity.
- File contents.
- Intent.
Hashes only demonstrate:
- Identity.
- Integrity.
- Equality.
Collision Risk in Practice
Algorithm Collision Status
MD5 Broken
SHA-1 Broken
SHA-256 Secure
SHA-512 Secure
Forensic laboratories increasingly prefer SHA-256 or SHA-512 for evidential verification.
However, MD5 remains widely used because of historical compatibility and extensive reference databases.
Forensic Tools Supporting Hash Analysis
Examples include:
- EnCase
- FTK
- X-Ways Forensics
- Autopsy
- Magnet AXIOM
These tools automatically calculate and verify hashes during acquisition and analysis.
Evidential Significance
Hash values are frequently included in:
- Forensic reports.
- Statements.
- Chain of custody documentation.
- Court exhibits.
- Validation records.
An examiner may state:
“The SHA-256 hash value of the forensic image matched the original media, demonstrating that the acquired image is an exact bit-for-bit duplicate of the source device.”
Conclusion
MD5 and SHA algorithms form the foundation of modern digital forensics.
Although MD5 and SHA-1 possess known cryptographic weaknesses, they remain useful for historical comparison and known-file identification. SHA-256 and SHA-512 are now considered the preferred algorithms for evidential integrity verification.
Hash analysis enables investigators to:
- Verify forensic images.
- Detect altered files.
- Identify known files.
- Filter large datasets.
- Correlate evidence.
- Validate evidence integrity.
- Support courtroom testimony.
For these reasons, cryptographic hashing remains one of the most important and universally applied techniques in digital forensic examinations.
About Athena Forensics
For information on our computer forensic expert services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to conclusion of the matter.
We are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 14 years.
Our premises along with our security procedures have been inspected and approved by law enforcement agencies and we do not disclose personal information to other companies or suppliers.
Our team are all security cleared and we offer non-disclosure agreements if required.
Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
