[Case Study] How to Verify Digital Evidence with Hash Value

Editor’s note:  Hash is a crucial part of digital forensics. Hash values can be considered as the signatures or fingerprints of data strings, files or even entire hard disks. The hash value is produced that identifies the contents of the file. If the contents are modified in any way, the value of the hash will also change significantly. This is why Hash is widely used in digital forensics to verify the integrity and originality of evidence data.

Related Product: DRS (Data Recovery System)

How to verify digital evidence with Hash value?

There are a few different ways to make verifications with Hash values according to different situations.

Generate Hash in forensic imaging.

When creating a forensic image of your source drive, you can let DRS generate the hash value for the image file automatically. This feature can be found in the forensic imaging module, target selection page.

After the imaging process is complete, you can find the Hash value in the imaging report.

You can also go to the image destination folder, and open the log file with the extension of “.MD5”. The Hash value can also be found in this file.

Generate Hash in file recovery.

Hash values will also be generated automatically after successful recovery of digital files. After you finish with the file recovery and extraction, open the report window and click “Details’ to view the file details. Hash values of each file can be found in the report table.

The report table is in HTML format so it will be opened by a web browser. Make sure to allow plugins to run.

Generate Hash with the Hash Calculator.

There is also a Hash Calculator in DRS toolbox, which allows you to generate the hash value of any data strings, files or entire hard disks. The Hash Calculator can be found in the main menu, toolbox.

After opening the tool, choose your source and click start to generate the Hash value.

Conclusion

Thanks for reading our [Tips] article! Keep following our blog, we’ll be posting more helpful small tips in the future. If you are interested in our mobile forensic product, come and check out our website for more information. You can also go to our resource page to download our forensic products for free. We welcome you to contact us and claim your free product trial!