A hash value is a fixed-length string calculated from a file or drive's contents, functioning as a digital fingerprint. Change a single bit and the hash changes completely, which is what allows an examiner to prove that a forensic copy is identical to its source and that nothing was altered between acquisition and analysis.
The property that makes it useful
A hash function takes input of any size and returns a value of fixed size — 32 hexadecimal characters for MD5, 64 for SHA-256. Two properties make it valuable in evidence work. It is deterministic, so the same input always produces the same output. And it is avalanche-sensitive: changing one bit of a 500 GB image produces a completely different hash, not a slightly different one.
That second property is why hashing detects alteration rather than merely summarising content. There is no such thing as a small change to a hash.
What examiners do with it
Verification. The imaging tool hashes the source as it reads and hashes the image it wrote. Matching values mean the copy is complete and accurate. This is the claim an examiner is asked to defend, and it is testable by anyone who has the image.
Integrity over time. Re-hashing the working copy before and after analysis shows that the examination did not modify the evidence. This is what closes the window between acquisition and the courtroom.
Deduplication. Identical files hash identically. In a review set of two million documents, hashing collapses the duplicates and can cut review cost substantially — which makes this a budget question as much as a technical one.
Known-file filtering. Reference libraries of hashes for standard operating system and application files let an examiner exclude tens of thousands of files that cannot be relevant, leaving the user-created material.
Identifying a file that has been renamed. Because the hash is computed from content, renaming q4-forecast.xlsx to vacation-photos.xlsx does not change it. Matching a hash found on a departing employee's personal device against one from the company's file server is direct evidence the file travelled.
MD5, SHA-1, SHA-256 — which and why
MD5 and SHA-1 are both cryptographically broken, in the specific sense that researchers can construct two different inputs that share a hash. That matters enormously for digital signatures. It matters far less for verifying that an image you just made matches the drive you just read, which is why MD5 remains common in forensic tooling and why courts have kept accepting it.
The honest position is that the attack is not realistic in the acquisition scenario, but SHA-256 costs almost nothing extra and removes the argument entirely. Most current tooling computes more than one hash at acquisition. If an opposing expert intends to spend an hour on MD5 collisions, an examiner who also recorded SHA-256 can end that line of questioning in a sentence.
A distinction worth keeping straight
Hashing is not encryption. Encryption is reversible with a key; hashing is one-way by design and nothing recovers the original from the hash. That is why password systems store hashes rather than passwords — and why, in breach analysis, whether credentials were hashed, and how, changes the notification analysis significantly.
From our work
Dealing with hash value in a live matter?
Our examiners and testifying experts work these questions for a living. Tell us what you're facing.
Reviewed by Law & Forensics. See our editorial standards.