What Is A Forensic Hash And Why Does It Matter

HASHVALUES · AGUIDEFORUKLAWYERS What Is a Forensic Hash and Why Does It Matter? MD5, SHA and Integrity, in Language a Court Will Follow COMPUTERFORENSICSLAB DISCOVERY . U K § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM COURT-EXPERIENCED EXPERT WITNESSES FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: "how do we know it is the same file?" 03 How hashing works, for non-mathematicians 04 The algorithm families: MD5, SHA-1, SHA-256 05 The collision question, answered honestly 06 What hashes are used for in practice 07 What a hash proves, and what it does not 08 The misconception gallery 09 Hashes in court: the exact language 10 Worked examples 11 Common mistakes and technical limitations 12 Questions to ask · Suggested wording 13 Checklist and red flags · When to involve a digital forensic expert 14 Frequently asked questions 15 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : AHASHPROVESIDENTITYANDINTEGRITY , ANDONLYTHAT § 0 2 · FIRSTPRINCIPLES The problem in plain English: "how do we know it is the same file?" § 0 3 · THEMECHANISM How hashing works, for non-mathematicians § 0 4 · THENAMES The algorithm families: MD5, SHA-1, SHA-256 ALGORITHM OUTPUT LENGTH STATUS AND ROLE IN PRACTICE § 0 5 · THEHARDQUESTION The collision question, answered honestly § 0 6 · THEWORKHORSE What hashes are used for in practice § 0 7 · THEBOUNDARY What a hash proves, and what it does not A MATCHING HASH PROVES A MATCHING HASH DOES NOT PROVE § 0 8 · THEGALLERY The misconception gallery § 0 9 · THELANGUAGE Hashes in court: the exact language Presenting your own evidence Challenging the other side's § 1 0 · INTHEWILD Worked examples EXAMPLE1 · THEPLANTINGALLEGATION , DISSOLVEDINFOURQUESTIONS EXAMPLE2 · " MD5ISBROKEN " MEETSTHEDISTINCTION EXAMPLE3 · THELATEHASHTHATCERTIFIEDAWEEK § 1 1 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 2 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · REQUESTFORVERIFIC AT IONM AT ERIAL § 1 3 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The hash-evidence checklist Red flags When to involve a digital forensic expert § 1 4 · COMMONQUESTIONS Frequently asked questions Can two different files ever share the same hash? Can a hash be reversed to reveal the document's contents? Should we insist on SHA-256 everywhere? What can be done if hashes were never taken? What is dual hashing, and is it necessary? Do hashes help us find our document on the other side's systems? § 1 5 · REFERENCE Glossary NSRL SHA-256 Sources and authoritative references 19 reporting of integrity evidence): cflab.uk/digital-forensics-services DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY