Hashing Files Project Paper
Victoria Robbins
Liberty University
Hash values can be defined as a “A unique hexadecimal value that identifies a file or
drive.” (Nelson, Phillips & Steuart, 4-8 hash value definition). Hash values are important in
computer forensics because they are used to verify the integrity of all digital forensics evidence
to show the files were not damaged, changed, etc. because without this proof the evidence could
be called into question during a trial and potentially be cast out as evidence and lead to the
integrity of other evidence items being questioned or cast doubt in the judge or juries minds
about the prosecutor’s case. According to Wang Xiaoyun and her associates from Beijing's
Tsinghua University and Shandong University of Technology forensics hash values have three
rules and those are:
You can't predict the hash value of a file or device. No two hash
values can be the same. (Note that collisions have occurred in
research using supercomputers.) If anything changes in the file or
device, the hash value must change. (Nelson, Phillips & Steuart, 4-
8).
The hashing website I used for this hashing value project was hashemall.com. The
hashing values I used were Message Digest 5 (MD5) and Secure Hash Algorithm version 1
(SHA1). Message Digest 5 (MD5) are mathematical algorithms that help determine whether a
files, folders or an entire drivers contents have been changed as a result of generating unique
hexadecimal values that can be used to identify and verify if there have been any changes to any
files, folders and drives. The Secure Hash Algorithm version 1 (SHA1) has been developed by
the National Institute of Standards and Technology (NIST). I created a new document and typed
in roughly five sentences and saved the document I then preceded to the hashemall.com website
where I received my documents first SHA1 hash value which resulted as
29BAF12B6B2DC21D5CA9EDE3B866D9089538EC35.
After receiving my first SHA1 hash I then selected the option for MD5 hash and received
FB099DB2BCCBB7ED98ADE45BBDC36BA3 has my has value. After receiving my original
hash values I then went back into my document and deleted one sentence and saved the changes
I then returned to the website where I received my new SHA1 hash value which was
EABE9E6E2DF984E42C722886AA61528EE4D391BB and my new MD5 hash value which
was B2D4BCD6F51CC6DCD919B5C6CA226292. The hash values were different to show that
the document had been changed and the integrity of the document was no longer intact. The
differences showed to me that the hash values noticed I had edited my document which supports
the fact that hash values are used in part to help keep track of and verify digital evidence
integrity which is necessary to record and preserve at all stages during an investigation to ensure
the credibility of the forensics examiner, the evidence’s integrity, the prosecution’s case and the
crimes committed by the defendant.
Hash values may seem to be of no importance to those outside of the digital forensics
field but to the experts and examiners within the field has values are of high importance to
calculate, record and preserve at all stages during and after an investigation because of the
importance of preserving and verifying the integrity of evidence both during the investigation
and trail. Not just to ensure the evidence can be used to prove a defendant’s guild but also to
prove and preserve the digital forensics examiners, a digital labs, potentially the police officers
and detectives and D.A’s integrity for past, current and future cases.
References
Nelson, B., Phillips, A., & Steuart, C. (2017). Guide to Computer Forensics and Investigations
Mindtap Security Lab, 1 Term 6 Months Access Card for Nelson/Phillips/steuarts Guide
to Computer Forensics and Investigations Via Live Virtual Machines (5th ed.). Cengage
Learning.
