Title: 8. Obtaining a Digital Hash
Course: IN 2005 Digital Forensics > Section: Module 5: Chapter 5 - Processing Crime and Incident Scenes

Obtaining a Digital Hash

1. Cyclic Redundancy Check (CRC) is a mathematical algorithm that determines whether a file’s contents have changed.  The most recent version is CRC-32.  CRC is not considered a forensic hashing algorithm.
2. Message Digest 5 (MD5) is a mathematical formula that translates a file into a hexadecimal code value, or a hash value. If a bit or byte in the file changes, it alters the digital hash.
3. The three rules for forensic hashes:
  - You can’t predict the hash value of a file or device
  - No two hash values can be the same
  - If anything changes in the file or device, the hash value must change
4. Secure Hash Algorithm version 1 (SHA-1) is a newer hashing algorithm developed by the National Institute of Standards and Technology (NIST).
5. In both MD5 and SHA-1, collisions have occurred.
6. Most computer forensics hashing needs can be satisfied with a nonkeyed hash set, which is a unique hash number generated by a software tool, such as the Linux md5sum command.  A keyed hash set is created by an encryption utility’s secret key.