Forensic Hash Verification.

The practice of computing and comparing cryptographic hashes (typically MD5 and SHA-256) of forensic images and source media to prove evidence integrity. It belongs to the Forensics & IR category of cybersecurity.

The practice of computing and comparing cryptographic hashes (typically MD5 and SHA-256) of forensic images and source media to prove evidence integrity.

Forensic hash verification is the foundational practice of computing cryptographic hashes such as MD5, SHA-1 and SHA-256 over digital evidence and matching them at every step to prove that the evidence has not been altered. During acquisition, hardware and software write-blockers and tools such as FTK Imager, Guymager or 'dd' compute a hash of the source media and of the resulting image; the hashes must match. Re-hashing on the workstation and at each transfer or restoration step is documented in the chain of custody. Standards such as NIST SP 800-86, SWGDE Best Practices and ISO/IEC 27037 require dual hashing (MD5 + SHA-256) because MD5 is no longer collision-resistant. Hash sets like NIST NSRL also help filter known good files.

Defences for Forensic Hash Verification typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Evidence hashing, Image hash verification, Forensic hashing.