Glossary term
Cryptographic Hash
A cryptographic hash is a fixed-length value computed from a file, an image, or any other input, designed so that any change to the input produces a different output.
In digital forensics, hashes verify that a working copy is identical to the original at the byte level. We compute MD5 and SHA-256 hashes at acquisition and re-verify them at every subsequent handling. A matching hash means the data has not changed; a mismatch means something has gone wrong and must be investigated before work continues.
MD5 produces a 128-bit hash and SHA-256 produces a 256-bit hash. We use both because legacy tools and counsel reports sometimes reference MD5 specifically, while SHA-256 has stronger collision resistance.
Hashes also support file identification. Forensic tools maintain libraries of known-good and known-bad file hashes (de-NIST lists, malware databases) to filter out irrelevant content quickly.