A hash value is a mathematically calculated verification value generated from a set of digital data. In digital forensics, it is primarily used to verify the integrity of files, disk images, and other digital evidence. If the same data set is later processed again using the same hashing algorithm and the same hash value is produced, this suggests that the data being examined has not changed since the original calculation.

Hash values ​​are therefore among the fundamental tools of digital forensics . They are used, among other things, for data backup, forensic images, file comparison, backup verification, and the documentation of digital evidence.

However, a hash value is not a universal proof of authenticity. It cannot answer who created a file, whether its content is factually correct, or whether the source data was manipulated before the first hash calculation. This distinction is crucial for the proper use of hash values.

What is a hash value explained simply?

A hash function processes an arbitrarily large amount of data and generates a hash value of a defined length. For example, in SHA-256, this hash value consists of 256 bits.

In simple terms, a hash value can be thought of as a technical fingerprint of a file or data set. Even a small change to the input data will very likely lead to a completely different result with a suitable cryptographic hash function.

This makes it possible to later check whether two data sets are identical or whether one of them has changed.

How is a hash value generated?

A file, a disk image, or another defined set of data is processed by a mathematical algorithm. The algorithm generates a hash value from this data.

For the same input data, the same hash function generally produces the same value. If even a single bit within the input data is changed, a significantly different hash value is usually generated.

This behavior makes hash functions particularly suitable for integrity checks.

Why are hash values ​​important in digital forensics?

Digital data can be technically altered very easily. Even a minimal change to a file can affect its content or metadata.

In a forensic investigation, it must therefore remain verifiable whether the examined data still corresponds to the state that was originally secured.

Hash values ​​enable precisely this kind of control. If a reference hash is calculated when backing up a data carrier, a new hash value can later be generated and compared with this reference value.

If both values ​​match, there is a very strong technical indication that the amount of data being tested has remained unchanged.

What does digital data integrity mean?

In a forensic context, integrity means that a defined set of data has not been altered compared to a known reference state.

This is not the same as authenticity. A file can be unchanged and still contain originally manipulated or false information.

Hash values ​​therefore primarily answer the question: Is this data set still the same as it was at the time the reference hash was calculated?

What is the difference between integrity and authenticity?

Integrity describes the unaltered state of a dataset. Authenticity, on the other hand, concerns whether a dataset actually originates from the claimed source or is genuine.

An example illustrates the difference: A manipulated image file is handed over to an IT forensics expert. Immediately after receiving the file, a SHA-256 hash is calculated. Three months later, the file still has the same hash value.

This shows that the file has remained unchanged since the original hash calculation. However, the hash value does not prove that the photo was never manipulated before being transferred.

What is SHA-256?

SHA-256 is a cryptographic hash function from the SHA-2 family. It generates a 256-bit hash value from an arbitrarily large input set.

SHA-256 is used today in numerous technical and security-related applications and is also suitable for modern forensic integrity checks.

The generated value is often represented as a 64-character hexadecimal string.

Why is SHA-256 used in IT forensics?

A modern hash function should possess two essential properties: It should be practically impossible to calculate the original data from the hash value, and it should be extremely difficult to create two different datasets with the same hash value.

SHA-256 currently meets these requirements for forensic integrity checks significantly better than older methods such as MD5 or SHA-1.

SHA-256 is therefore a sensible choice for new investigation workflows.

What is MD5?

MD5 is an older cryptographic hash function that produces a 128-bit hash value.

The method was widely used in digital forensics for many years. Numerous older forensic programs and image formats still support MD5.

However, for cryptographic security applications, MD5 is now considered broken because targeted collisions can be generated.

Is MD5 still usable for digital forensics?

That depends on the specific purpose. For the sole purpose of detecting unintentional data changes, an MD5 checksum can still technically provide practical verification information.

However, for new evidence-relevant workflows, a more modern method such as SHA-256 should be preferred.

It would be particularly problematic to present MD5 as an unconditionally collision-proof cryptographic proof.

What is SHA-1?

SHA-1 generates a 160-bit hash value and has also been used for many years in numerous IT and forensic environments.

Practical collision attacks have also been demonstrated with SHA-1. Therefore, this method is no longer recommended for modern safety-critical applications.

SHA-1 values ​​may still occur in older forensic datasets and be relevant for comparisons with historical backups.

What does a hash collision mean?

A hash collision occurs when two different datasets produce the same hash value.

Since a hash value has a fixed length, while theoretically infinitely many different input data are possible, collisions must mathematically exist in principle.

Therefore, the crucial question is not whether collisions are theoretically possible, but how difficult it is in practice to deliberately create such a collision.

Why are collisions relevant to forensics?

If a hash function allows targeted collisions relatively easily, its value as the sole cryptographic proof of integrity can be weakened.

That is precisely why modern hash functions are preferred, where the targeted generation of suitable collisions is practically unrealistic.

For forensic practice, this means that the selection of the hash algorithm should be documented and technically appropriate.

What is the probability of a random SHA-256 collision?

For practical forensic applications, the probability of a random SHA-256 collision is extremely low.

The range of values ​​for SHA-256 comprises 2 to the power of 256 possible hash values. Even taking the so-called birthday paradox into account, a random, relevant collision is far outside the realm of realistic forensic data sets.

This is one of the reasons why SHA-256 is suitable for integrity checks.

What is the avalanche effect?

A good cryptographic hash function exhibits a so-called avalanche effect. Even a minimal change in the input data leads to a significantly altered hash value.

For example, if only a single bit is changed within a large file, the resulting SHA-256 value can be completely different.

This makes hash values ​​very sensitive to data changes.

What does "deterministic" mean in the context of a hash function?

A hash function is deterministic if the same input always produces the same hash value.

A file with exactly the same content will therefore yield the same SHA-256 value when using SHA-256, regardless of when the calculation is performed.

This is a fundamental requirement for forensic comparative testing.

Is it possible to calculate the original file from a hash value?

A cryptographic hash function is designed as a one-way function. It should be practically impossible to reverse-engineer the original input from the hash value alone.

This is what distinguishes hashing from encryption. Encryption should be reversible with the correct key. A hash value, on the other hand, is not intended for decryption.

Hashing is not encryption.

Hashing and encryption are often confused, but they pursue different goals.

Encryption protects the content of data from unauthorized access. The data can be decrypted again using the correct key.

In contrast, a hash function generates a test value. It is primarily used in digital forensics for integrity and comparison checks.

How is a file hashed?

The bytes of a file are completely processed by the selected hash function. The result is a hash value that relates exclusively to this specific set of data.

If the file content is changed, a different hash value is generated.

Which file system metadata is included in the hashing depends on what exactly is being hashed. With normal file hashing, typically only the file content is hashed, and not automatically every piece of file system information about that file.

Does the hash value change when a file is renamed?

If only the filename is changed and the file content remains unchanged, a hash value calculated from the file content alone will usually remain the same.

In this case, the filename is file system information and not part of the hashed file content.

This shows why, in a forensic evaluation, it is always necessary to know the specific amount of data that was hashed.

Does the hash value change when a file is moved?

If a file is only moved to a different folder and its contents are not changed, a content hash such as SHA-256 remains fundamentally the same.

File system metadata can still change as a result of such a process.

Therefore, an unchanged file hash does not mean that no operations have taken place on the file.

Does the hash value change when a timestamp changes?

If only an external file system timestamp is changed and the actual file content remains unchanged, the hash value of the file content does not need to change.

However, if a timestamp is stored and changed within the file format itself, the file content and therefore the hash value can also change.

This distinction is important when interpreting digital evidence.

What is a hash value of a data carrier?

For a data storage medium, a hash value can be calculated over the entire captured data stream.

In the case of sector-by-sector backup, this includes, for example, all data blocks read during the backup process within the defined area.

The resulting hash value then represents not a single file, but the entire hashed data set.

What is the hash value of a forensic image?

A forensic image can also be hashed. However, it is important to distinguish precisely what is being hashed.

In a RAW image, the stored data stream can directly correspond to the read data stream from the storage medium.

Structured container formats can contain additional metadata, compression, validation information, and container structures. Therefore, a hash of the entire container file does not necessarily describe the exact same byte sequence as a hash of the original raw data.

Why can the source hash and image hash be different?

This is particularly important for container formats.

When a raw data stream is captured from a data carrier and then compressed or embedded in a container, the external file structure changes.

A hash of the entire container file may therefore yield a different value than a hash of the original logical raw data stream, even though the payload contained within it was correctly preserved.

The documentation must therefore clearly state which value refers to which data level.

What does image verification mean?

Image verification is the verification of a generated forensic image after it has been backed up.

The image is read again and its verification information is compared with the reference values ​​generated during or immediately after the acquisition.

This allows you to check whether changes or errors have occurred during storage or transmission.

When should a hash value be calculated?

A hash value should be calculated at a time when a defined reference state exists.

In a classic forensic image, this can happen immediately during or after the acquisition.

Subsequent tests can then be compared with this reference value.

Why is documenting the hash time important?

A hash value only has a clear meaning if it is known to which state of the data it refers.

If a hash is calculated only after several processing steps, it can only document the integrity from this later state onwards.

He cannot retrospectively prove that the data remained unchanged during earlier processing steps.

What is hash matching?

Hash matching refers to the comparison of a calculated hash value with previously known hash values.

This allows identical files to be identified very quickly without having to manually compare their contents individually.

This is used in digital forensics, among other things, to identify known system files, known malware, or already classified files.

What is a hash database?

A hash database contains known hash values ​​of specific files.

Forensic software can compare the hash values ​​of examined files with such databases. This allows, for example, known operating system files to be filtered out from large datasets.

The reverse approach can be used to specifically search for known relevant files.

Why can hash sets speed up analysis?

A modern computer can contain millions of files. Many of these are standard files of the operating system or installed software.

If their hash values ​​are already known, they can be automatically recognized as known files in certain investigations.

This reduces the amount of data that an investigator has to manually evaluate.

What does Known Good mean?

Known-Good hashsets contain hash values ​​of files that have already been classified as known regular files.

This can include, for example, standard operating system files.

Such files do not need to be manually re-evaluated during every investigation, provided their identity can be reliably determined via the hash value.

What does "Known Bad" mean?

Known-Bad hashsets contain hash values ​​of files that have already been classified as relevant, unwanted, or harmful.

This could include, for example, known malware.

A match initially only means that the examined file has the same relevant hash value as the known reference set. The file's context still needs to be evaluated.

Can a hash value detect malware?

A hash comparison can identify known malware if the exact same file is already contained in a reference database.

However, even a small change to the malware usually alters the hash value.

Hash matching alone is therefore not sufficient to detect all variants of a malware program.

What is fuzzy hashing?

Classic cryptographic hash functions like SHA-256 are very sensitive to changes. Even a minimal change produces a completely different hash value.

For certain forensic tasks, however, it can be useful to identify similar files. This is where so-called similarity hashing or fuzzy hashing methods come into play.

They serve a different purpose than SHA-256 and are intended to detect structural similarities between files.

Is fuzzy hashing a replacement for SHA-256?

No. Both methods answer different questions.

SHA-256 is ideally suited for integrity checking and for determining identical data.

Fuzzy hashing, on the other hand, is primarily used to find similar files. It is therefore not a replacement for a cryptographic integrity hash.

What role do hash values ​​play in the chain of evidence?

Hash values ​​can document, within a traceable chain of evidence, that a specific digital dataset has remained unchanged during various processing steps.

However, they do not replace the organizational documentation about who received, secured, transported or examined the evidence.

The technical integrity check and the chain of custody therefore complement each other.

Can a hash value replace the chain of custody?

No. An identical hash value merely indicates that a defined set of data remains unchanged.

He does not say who owned the medium or who had access to it, or when.

Therefore, professional documentation of evidence must transparently record both technical integrity checks and organizational handovers.

What happens if two hash values ​​don't match?

Different hash values ​​initially mean that the amounts of data being hashed differ.

The cause must then be determined. Possible causes include actual data changes, different data areas, a backup error, different container states, or an incorrect basis for comparison.

A different hash value should not be hastily interpreted as proof of manipulation.

Why is the basis of comparison crucial?

Two hash values ​​can only be meaningfully compared if they were calculated using the same algorithm over the same defined data set.

A SHA-256 value cannot be directly compared to an MD5 value.

Likewise, a hash of a single file is not comparable to a hash of an entire data carrier.

What does hashing mean in the context of a bitwise copy?

In sector-by-sector data carrier backups, a hash value can be used to verify the captured raw data stream or the resulting image.

This allows you to check whether the backup still corresponds to the documented state later on.

However, in the case of damaged data carriers or read errors, it must be taken into account how the imaging tool treated these areas.

What happens to hash values ​​in case of read errors?

If individual sectors of a data carrier cannot be read, the resulting hash value depends on the specific backup method.

The imaging tool can, for example, handle unreadable areas according to a defined strategy.

It is therefore important to document read errors and not to misunderstand the hash value as proof of the complete and error-free capture of a data carrier.

Can a corrupted file retain the same hash value?

If even one bit of the actually hashed file content changes, a different hash value is extremely likely to result with SHA-256.

If the content hash remains identical, this strongly suggests that the hashed file content has remained unchanged.

Can a file be copied and retain the same hash value?

Yes. An identical copy of a file has the same content hash as the original.

That's precisely why hashing is ideally suited to determining whether two files are identical in content.

However, the hash value does not reveal which file existed first or which copying operation took place.

Can the same hash value appear on two computers?

Yes. If the same identical file is located on two computers, it will have the same hash value when the same hashing method is used.

This can be very helpful in forensic comparisons.

However, it does not automatically prove how the file got from one system to another.

Can a hash value prove data theft?

A hash value can show that a file is identical in content on two systems or storage media.

This can be a relevant clue in a data theft investigation . However, it alone does not reveal who copied the file, when the transfer took place, or whether authorization existed.

For a reliable reconstruction, further system and user artifacts must be included.

Practical example: Forensic image of a company hard drive

A company computer is to be examined due to suspected unauthorized data leakage. The data storage device will be secured under controlled conditions.

Following the acquisition, a SHA-256 value of the defined security portfolio is documented.

The subsequent analysis will be carried out on a working copy. Months later, a second expert will review the results.

If the same SHA-256 value is calculated again for the archived source image, it can be verified that this data set has remained unchanged since the original backup.

Practical example: Two seemingly identical documents

There are files with the same name "CustomerList.xlsx" on two different data carriers.

Having the same filename does not prove that both files are identical. However, if identical SHA-256 hashes are calculated for both files, this strongly suggests that the hashed file content is identical.

However, this does not yet clarify where the file was originally created or which data carrier was the source.

Practical example: Changing a single character

A Word document contains a contract. In a second version, only one number within the document was changed.

Although both documents appear almost identical to the viewer, changing the file content results in a different SHA-256 value.

A hash comparison can therefore very quickly show that the files are not identical. What specific change was made must then be determined through a content-based or forensic comparative analysis.

Practical example: File on a USB stick

An internal investigation uncovers a file on a USB stick that has the same SHA-256 value as a confidential document on a company computer.

This confirms that the hashed file contents are identical.

The hash value alone does not prove that the employee personally copied this file from the company computer to this specific USB stick. This requires examining USB artifacts, timestamps, and user activity, among other things.

Practical example: Smartphone data

Hash values ​​can also be used in smartphone forensics to check the integrity of exported files or certain backed-up data sets.

However, with mobile extractions, it is essential to carefully consider which data is generated by the respective extraction method and which data set was actually hashed.

A hash value cannot eliminate the technically inherent differences between logical extraction, file system extraction, and other acquisition methods.

Typical mistakes when handling hash values

A common mistake is to describe a hash value as comprehensive proof of authenticity. In fact, it primarily confirms the integrity of a defined data set against a reference value.

It is equally problematic to compare hash values ​​that were calculated using different algorithms or across different data layers.

The statement that two identical file hashes automatically prove a specific copying operation is also technically too far-reaching.

Another problem arises when hash values ​​are documented, but it is later no longer possible to trace which specific file, partition, or image layer was originally hashed.

What information should be recorded when documenting a hash value?

A comprehensible documentation should at least show what amount of data was hashed, which algorithm was used, and what hash value was generated.

Depending on the case under investigation, additional information such as time, evidence identification, image description and tool used may be relevant.

The hash value should be uniquely assignable to the corresponding data set.

FAQ on hash values ​​in digital forensics

What is a hash value explained simply?

A hash value is a mathematically calculated checksum of a digital data set. It can be used to later verify whether the data has changed.

What is a SHA-256 hash?

SHA-256 is a cryptographic hash function that generates a 256-bit checksum. It is suitable, among other things, for modern forensic integrity checks.

Why are hash values ​​used in IT forensics?

They enable traceable control of whether a file, an image, or another defined data set has been changed compared to a reference state.

Does a hash value prove the authenticity of a file?

Not entirely. A hash value can verify that something has not been altered compared to a reference state. It does not automatically prove origin, authorship, or factual accuracy.

Can a manipulated file have a valid hash value?

Yes. Every file has a calculable hash value. If a manipulated file is hashed, the hash value describes only that manipulated version.

Can manipulation be detected using a hash value?

If a trusted previous reference hash exists and the current hash value differs from it, it is clear that the hashed data is different. The cause of the change must be investigated separately.

Which is better: MD5 or SHA-256?

For new forensic integrity checks, SHA-256 is generally the more modern choice. MD5 is no longer cryptographically collision-proof and should not be presented as an unconditionally secure proof.

Is SHA-1 still secure?

For modern cryptographic security applications, SHA-1 is no longer considered collision-proof. Historical SHA-1 values ​​may still be relevant for existing older backups.

Can SHA-256 also have collisions?

Mathematically, collisions must exist for a hash function with a limited range of values. However, for SHA-256, a practically relevant random or intentionally exploitable collision is not realistic in normal forensic applications according to current standards.

Does the hash value change if I rename a file?

This is not usually the case with a hash of the file content alone. The filename is not part of the actual file content.

Does the hash value change when I copy a file?

If the copy is identical in content, the content hash remains the same.

Does the hash value change if I change just one character?

Yes. Even a minimal change to the file content will very likely result in a completely different hash value when using SHA-256.

Does the hash value change when a file is moved?

If the file content remains unchanged, a content hash typically does not change. However, file system metadata can still change.

Can I use a hash value to determine when a file was created?

No. A hash value does not contain any information about the creation date of a file.

Can a hash value show who created a file?

No. A hash value identifies the data set, not its author.

Can a hash value prove that a file has been copied to a USB stick?

Not alone. Identical hash values ​​can indicate that two files contain the same content. The actual copying process must be investigated using further digital traces.

Can a hash value be described as a digital fingerprint?

As a simplified explanation, yes. Technically, it should be clarified that this is a calculated test value and not a definitive proof of origin.

Can the hash value of an image be re-verified later?

Yes. This is a typical use case. If the same hash value is calculated again later for the same defined data set, the integrity can be checked against the documented reference state.

What happens if the hash value is no longer correct?

Then the hashed data sets will differ. The cause could be an actual change, a technical error, or a different basis for comparison, and this needs to be investigated.

Is a hash value alone sufficient evidence in court?

No. A hash value is a technical tool for integrity checks. The evaluation of digital evidence also depends on the storage method, documentation, origin, chain of evidence, and the specific legal context.

Why hash values ​​are so valuable and yet still need to be interpreted correctly

Hash values ​​are among the most reliable and simplest control mechanisms in digital forensics. They allow a defined dataset to be unambiguously assigned to a documented technical state and subsequently checked for changes.

Its value lies precisely in this clearly defined function. A hash value answers the question of integrity, but not automatically of authenticity, authorship, or origin.

Professional forensics therefore does not use hash values ​​as a blanket seal of quality. It documents which algorithm was used, which data was hashed, and at what time the reference value was generated.

Only in combination with verifiable data backup, clean documentation of evidence and professional analysis does the hash value become a reliable component of digital evidence preservation.

Back to knowledge overview