Creating strong hashes for evidence integrity

To provide proof that evidence was not tampered with, a cryptographic algorithm must be run against the evidence drive before, during, and after a forensic acquisition. These algorithms produce an output string (or hash output) of hexadecimal characters (a–f and 0–9) of various lengths, depending on their strength.

Common cryptographic algorithms are as follows:

• MD5: Message Digest 5
• SHA-1: Secure Hash Algorithm version 1
• SHA-256: SHA-2 256-bit

Note

More information on cryptographic hashes can be found at https://www.tutorialspoint.com/cryptography/cryptography_hash_functions.htm.

In Kali Linux, we can use the md5sum, sha1sum, or sha256sum commands, followed by the path of the device, to create a hash output of the evidence/input file. For example, to create a SHA-256 hash, we would use the following command, where sdx represents the drive we are trying to acquire or image:

Sha256sum /dev...