Hash verification is a method of proving integrity by computing and comparing a fixed-length output (digest), the cryptographic fingerprint of a piece of data. MD5 (128-bit) and SHA-1 (160-bit) are considered deprecated due to collision attacks; SHA-256 is the modern standard defined by NIST FIPS 180-4. Forensic practice is to compute SHA-256 together with MD5 as a dual confirmation.

TL;DR

  • Hash = a fixed-length cryptographic data fingerprint.
  • MD5 (128-bit) and SHA-1 (160-bit) are collision-prone and deprecated.
  • SHA-256 (256-bit, FIPS 180-4) is today's forensic standard.
  • SHA-3 (Keccak) is the next generation, not yet widespread in forensics.
  • Best practice: SHA-256 + MD5 dual confirmation, ISO/IEC 27037 compliant.

Detailed Answer

How does a hash work?

A cryptographic hash function is a one-way mathematical function that converts an input of any length into a fixed-length output. Three core properties are expected:

  1. Preimage resistance: it must be infeasible to recover the input from the hash.
  2. Second preimage resistance: it must be practically impossible to find a second input that produces the same hash.
  3. Collision resistance: the probability that two random inputs produce the same hash must be negligible.

Even if a single bit changes, the output is radically different (the avalanche effect).

Algorithm comparison

Algorithm Output size Status Typical use
MD5 128-bit Deprecated (1996 weakness, 2004 collision) Fast integrity, secondary confirmation
SHA-1 160-bit Deprecated (2017 SHAttered collision) Legacy system compatibility
SHA-256 256-bit Active standard Forensics, signatures, TLS
SHA-384 384-bit Active High security
SHA-512 512-bit Active Fast on 64-bit systems
SHA-3 (256) 256-bit Next generation (FIPS 202) Future readiness
BLAKE3 Variable Performance-focused Backup, distributed systems

NIST FIPS guidance

NIST FIPS 180-4 is the official specification for the SHA family (SHA-1, SHA-224, SHA-256, SHA-384, SHA-512). NIST SP 800-131A lists which algorithms are considered prohibited as of which dates. The plan is to retire all uses of SHA-1 by the year 2030. SHA-3 (Keccak), in turn, is defined as a separate family under FIPS 202.

Why dual hashing in forensics?

A single hash satisfies the evidence-integrity requirement of ISO/IEC 27037; however, dual hashing strengthens defensibility. Forcing MD5 and SHA-256 into a collision at the same time (a chosen-prefix collision) is practically infeasible. For this reason, imaging tools (FTK Imager, dd, X-Ways) compute both hashes by default. For process details, see our article What ISO/IEC 27037 is used for.

Practical use: dd and sha256sum

The classic workflow in a Linux environment:

  1. dd if=/dev/sdb of=image.dd bs=4M status=progress
  2. sha256sum image.dd > image.dd.sha256
  3. md5sum image.dd > image.dd.md5
  4. Hashes are compared before and after storage.

On the Windows side, PowerShell Get-FileHash -Algorithm SHA256 or FTK Imager is used.

Hash collision examples

  • 2008: A forged SSL certificate was produced with MD5 (Sotirov et al.).
  • 2017: Google's SHAttered demonstrated a practical collision on SHA-1.
  • 2020: The cost of a SHA-1 chosen-prefix attack dropped to USD 45,000.
  • A practical collision on SHA-256 is unknown as of 2026.

This shows that organizations still using MD5 alone in legacy backup systems are putting the integrity of their backups at risk. For a modern backup strategy, our article HDD vs SSD lifespan comparison may be useful.

Hardware acceleration

Modern CPUs compute SHA-256 with the Intel SHA-NI or ARMv8 SHA extensions at 3 to 10 times the speed of software. As of 2026, SHA-256 is not a bottleneck when imaging from NVMe SSDs; 2 to 4 GB can be computed per second.

The difference between a hash and a digital signature

A hash provides integrity, but it does not authenticate identity. Encrypting the hash with a private key creates a digital signature (RSA, ECDSA, EdDSA). If forensic reports are published with a SHA-256 hash plus a digital signature (PAdES, CAdES), both integrity and non-repudiation are ensured.

Backup and ransomware scenario

After a ransomware incident, the only way to prove that backups are clean is by comparing hashes. When a backup is taken, the SHA-256 values are stored on a separate system. During restore, the value is recomputed and compared. The Ransomware first 24 hours action timeline ties this verification step to the timeline.

Synology NAS example

Synology keeps a per-file checksum on Btrfs and verifies it during reads; however, this is not a forensic hash. For forensic examination, an image is taken from the device and an external SHA-256 is computed. For details, see our article Synology NAS crashed: data recovery SHR.

Frequently Asked Questions (FAQ)

Can MD5 still be used?

It should not be used for cryptographic security. It is acceptable only for fast integrity confirmation and as a secondary check alongside SHA-256. MD5 should not be the priority choice when designing a new system.

When will SHA-1 be completely banned?

NIST SP 800-131A has prohibited all digital-signature uses of SHA-1; the plan is to remove it completely from all applications by the year 2030. It has not been accepted in TLS certificates since 2017.

Is SHA-256 sufficient in forensics?

On its own it is legally sufficient, but the dual-hash practice (SHA-256 + MD5) provides a strong defensive posture. In highly critical cases, SHA-512 or SHA-3-256 can be computed in addition.

What should I do if the hash result comes out different?

First, the computation method and the accuracy of the tool are tested (with a known sample). Then it is checked whether the original media has changed. If the chain of custody is broken, the image must be retaken and the situation recorded in a written report.

How does DSET present hash verification in its report?

DSET forensic reports present the SHA-256 and MD5 values of the captured image, the computation date and tool, in an ISO/IEC 27037-compliant chain-of-custody appendix. Contact: Hacettepe Teknokent Beytepe, +90 536 662 38 09, [email protected].