What is a hash value in digital forensics?

A hash value is a short, fixed-length "fingerprint" calculated from a piece of digital data. The data can be a single email, a spreadsheet, an entire hard drive or a mobile phone extraction. A hash function processes every bit of the input and produces an output that is, for practical purposes, unique to that exact content. If anything changes, even a single character or a hidden metadata field, the hash changes completely.

How does hashing work?

A hash function is a one-way algorithm. It is easy to compute the hash from the data, but it is not feasible to rebuild the data from the hash. The output length is fixed regardless of input size:

A "collision" occurs when two different inputs produce the same hash. Researchers have shown practical collisions for MD5 and SHA-1, which is why many examiners now record SHA-256 as the primary value.

How are hash values used in digital forensics?

• Verifying a forensic image: the examiner hashes the original device and the forensic image. If the values match, the image is an exact copy.
• Proving integrity over time: re-hashing evidence before analysis, or before trial, shows it has not changed since acquisition.
• Supporting chain of custody: hash values are recorded on custody forms so each hand-over can be checked, strengthening the chain of custody.
• De-duplication in eDiscovery: identical files share the same hash, so duplicates can be removed before review, reducing volumes in eDiscovery.
• Known-file filtering: hashes of standard operating system files can be excluded, and hashes of known illicit or confidential files can be searched for across many devices.

What does Indian law require?

The Bharatiya Sakshya Adhiniyam 2023 (BSA) makes hash values part of the admissibility process for electronic records. Section 63, which replaced s. 65B of the Indian Evidence Act 1872, requires a certificate to accompany computer output each time it is submitted. The certificate is in the form set out in the Schedule to the BSA:

• Part A is completed by the party producing the record.
• Part B is completed by an expert.
• Both parts record the hash value(s) of the electronic record, with the algorithm identified as SHA1, SHA256, MD5 or another legally acceptable standard, and a hash report is attached.

This is a notable change from the old s. 65B certificate, which did not expressly require hash values. Parties now need hash values calculated and documented properly from collection onwards, or the Section 63 certificate may be hard to complete accurately. Our article on electronic evidence under the Bharatiya Sakshya Adhiniyam explains the certificate in more detail.

What problems arise with hash values in practice?

• Hashes calculated only after the evidence has been handled, so they prove nothing about its earlier state.
• Hashing a printout or screenshot instead of the native file.
• Recording only MD5 when the other side challenges its reliability.
• Mismatched hashes for live systems or cloud exports, which change constantly and need careful documentation of when and how data was captured.
• Hash values typed by hand into reports with transcription errors.

How is a hash value different from encryption or a digital signature?

Encryption is reversible with the right key and is used to keep data confidential; hashing is one-way and is used to check integrity. A digital signature combines a hash with a private key to prove both integrity and the signer's identity. In digital forensics, a plain hash is usually enough to show evidence is unchanged, with attribution established separately. Our digital forensics and eDiscovery service covers forensic acquisition, including recording and reporting hash values.