Page 1

HASHVALUES · A GUIDE FOR UK LAWYERS What Is a Forensic Hash and Why Does It Matter? MD5, SHA and Integrity, in Language a Court Will Follow COMPUTER FORENSICS LAB DISCOVERY. UK

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM COURT-EXPERIENCED EXPERT WITNESSES FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: "how do we know it is the same file?" 03 How hashing works, for non-mathematicians 04 The algorithm families: MD5, SHA-1, SHA-256 05 The collision question, answered honestly 06 What hashes are used for in practice 07 What a hash proves, and what it does not 08 The misconception gallery 09 Hashes in court: the exact language 10 Worked examples 11 Common mistakes and technical limitations 12 Questions to ask · Suggested wording 13 Checklist and red flags · When to involve a digital forensic expert 14 Frequently asked questions 15 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: AHASHPROVESIDENTITYANDINTEGRITY, AND ONLY THAT

§ 02 · FIRST PRINCIPLES The problem in plain English: "how do we know it is the same file?"

§ 03 · THEMECHANISM How hashing works, for non-mathematicians