Algorithms

In this section, we describe the main differences between MD5, SHA256, and SSDEEP—the most common algorithms used in the forensic investigations. We will explain the use cases as well as the limitations and threats behind these three algorithms. This should help you understand why using SHA256 is better than using MD5 and in which cases SSDEEP can help you in the investigation.

Before we dive into the different hash functions, we will give a short summary of what a cryptographic hash function is.

A hash function is a function that maps an arbitrarily large amount of data to a value of a fixed length. The hash function ensures that the same input always results in the same output, called the hash sum. Consequently, a hash sum is a characteristic of a specific piece of data.

A cryptographic hash function is a hash function that is considered practically impossible to invert. This means that it is not possible to create the input data while having a pre-defined hash sum value...