Glossary term
Hash Value
A hash value is a fixed-length output computed from any input data using a cryptographic hash function. Identical inputs always produce identical hash values, so any change to the input produces a different hash.
Hash values are the primary integrity check in forensic work. We compute MD5 and SHA-256 hashes at acquisition, then re-verify them at every subsequent handling. A matching hash means the data has not changed; a mismatch means something has gone wrong.
MD5 produces a 128-bit value and SHA-256 produces a 256-bit value. We compute both because legacy reports and tooling often reference MD5, while SHA-256 has stronger resistance to collision attacks.
Hash values also support file identification. Forensic tools maintain libraries of known file hashes: NIST National Software Reference Library (de-NIST) lists for filtering out known operating-system files, malware hash databases for identifying malicious content, and prior-matter hash sets for identifying previously-seen evidence.