Page 1
HASHVALUES · A GUIDE FOR UK LAWYERS What Is a Forensic Hash and Why Does It Matter? MD5, SHA and Integrity, in Language a Court Will Follow COMPUTER FORENSICS LAB DISCOVERY. UK
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM COURT-EXPERIENCED EXPERT WITNESSES FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: "how do we know it is the same file?" 03 How hashing works, for non-mathematicians 04 The algorithm families: MD5, SHA-1, SHA-256 05 The collision question, answered honestly 06 What hashes are used for in practice 07 What a hash proves, and what it does not 08 The misconception gallery 09 Hashes in court: the exact language 10 Worked examples 11 Common mistakes and technical limitations 12 Questions to ask · Suggested wording 13 Checklist and red flags · When to involve a digital forensic expert 14 Frequently asked questions 15 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: AHASHPROVESIDENTITYANDINTEGRITY, AND ONLY THAT
§ 02 · FIRST PRINCIPLES The problem in plain English: "how do we know it is the same file?"
§ 03 · THEMECHANISM How hashing works, for non-mathematicians
Page 2
§ 04 · THENAMES The algorithm families: MD5, SHA-1, SHA-256 ALGORITHM OUTPUT LENGTH STATUS AND ROLE IN PRACTICE
§ 05 · THEHARDQUESTION The collision question, answered honestly
§ 06 · THEWORKHORSE What hashes are used for in practice
§ 07 · THEBOUNDARY What a hash proves, and what it does not A MATCHING HASH PROVES A MATCHING HASH DOES NOT PROVE
§ 08 · THEGALLERY The misconception gallery
§ 09 · THELANGUAGE Hashes in court: the exact language Presenting your own evidence Challenging the other side's
Page 3
§ 10 · IN THE WILD Worked examples EXAMPLE1 · THEPLANTINGALLEGATION, DISSOLVEDINFOURQUESTIONS EXAMPLE2 · " MD5ISBROKEN " MEETSTHEDISTINCTION EXAMPLE3 · THELATEHASHTHATCERTIFIEDAWEEK
§ 11 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 12 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · REQUESTFORVERIFIC AT IONM AT ERIAL
§ 13 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The hash-evidence checklist Red flags When to involve a digital forensic expert
§ 14 · COMMON QUESTIONS Frequently asked questions Can two different files ever share the same hash? Can a hash be reversed to reveal the document's contents? Should we insist on SHA-256 every where? What can be done if hashes were never taken? What is dual hashing, and is it necessary? Do hashes help us find our document on the other side's systems?
§ 15 · REFERENCE Glossary NSRL SHA-256 Sources and authoritative references 19 reporting of integrity evidence): cflab.uk/digital-forensics-services DISCLAIMER
Page 4
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, What Is A Forensic Hash And Why Does It Matter, Computer Forensics Lab, https://e-discovery.uk/library/what-is-a-forensic-hash-and-why-does-it-matter/pdf.