Could you please ex...
 
Notifications
Clear all

Could you please explain me about verification hash

5 Posts
5 Users
0 Likes
2,356 Views
(@hopeanddream)
Posts: 1
New Member
Topic starter
 

Why there need to be a verification hash. Isn’t acquisition hash enough ?
What is the real benefit of verification hash.

 
Posted : 09/02/2018 3:38 am
Shourjo
(@shourjo)
Posts: 14
Active Member
 

Hi,
Acquisition hashes are calculated to uniquely identify the data. However, verification hashes are calculated to maintain the integrity of the acquired data. verification hashes ensure that the acquired image or data has not been modified by recalculation of the acquired image and verification.
Hope this resolves your query.

 
Posted : 09/02/2018 7:02 am
nightworker
(@nightworker)
Posts: 134
Estimable Member
 

I thınk he asking the verification after first image at the same time.I always thinking why we are verifying aquistion hash.

 
Posted : 09/02/2018 7:12 am
(@hommy0)
Posts: 98
Trusted Member
 

The purpose of verification directly after acquisition (for me) provides that level of reassurance that the content of the evidence file matches that of the source media.
If we think that the acquisition hash is of the source media (from sector 0 to sector N), this just tells us the "fingerprint" of that device.
The verification has relates to the content within the evidence file as has been acquired, hence this needs to be a direct replica of the source (exhibit).

To calculate verification hash directly after acquisition informations the examiner that they have a good and accurate "copy" of the exhibit media.

Think that the original media may not been retained for many reasons, you will need to be confident before handing back the original that the acquisition is a true and accurate copy - since you may not have the luxury of reacquiring the original at future point in time.

I certainly have had acquisitions where the acquisition and verification hashes have not matched (immediately after acquisition).

 
Posted : 09/02/2018 9:14 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Why there need to be a verification hash. Isn’t acquisition hash enough ?
What is the real benefit of verification hash.

In a nutshell, the acquisition hash represents the data read from the "original", the verification hash represents the data as written to the "image" (or clone), or even more properly, the data read from the "image" once it was written.

See
https://www.forensicfocus.com/Forums/viewtopic/t=11739/

jaclaz

 
Posted : 09/02/2018 11:09 am
Share: