Title: 5. Validating Data Acquisitions
Course: IN 2005 Digital Forensics > Section: Module 4: Chapter 4 - Data Acquisition

Validating Data Acquisitions

1. Validating digital evidence is probably the most critical aspect of computer forensics.
2. Validating digital evidence requires using a hashing algorithm utility.  Hashing algorithms range from CRC-32, MD5 and SHA-1 to SHA-512.

Linux Validation Methods

1. Md5sum or sha1sum utilities should be run on all suspect disks and volumes or segmented volumes.

Windows Validation Methods

1. Windows has no built-in hashing algorithm tools for computer forensics, but third-party utilities can be used.
2. Commercial computer forensics programs also have built-in validation features.  Each program has its own validation technique.
3. Raw format image files don’t contain metadata, so separate manual validation is recommended for all raw acquisitions.