A cryptographic hash function produces a value derived from file contents. Identical files produce identical hashes, and any change to the file produces a different value. Common algorithms include MD5 and SHA-256.
Hashes support deduplication, chain of custody verification, and detection of alteration.
Alternative Names:
Hash, MD5 Hash, Digital Fingerprint
Why it Matters?
Hashes are what make collection integrity provable rather than asserted. Computing a hash at collection and again at production establishes that the file was not altered in between, which is the technical foundation of chain of custody for electronic evidence. They also enable exact deduplication and DeNIST filtering, since matching hashes identify identical files regardless of name or location.
Frequently Confused with
Related terms
Frequently asked questions
What does a matching hash prove?
Why are hashes used for deduplication?
