Join Us!

Could you please ex...
 
Notifications
Clear all

Could you please explain me about verification hash  

  RSS
hopeanddream
(@hopeanddream)
New Member

Why there need to be a verification hash. Isn’t acquisition hash enough ?
What is the real benefit of verification hash.

Quote
Posted : 09/02/2018 3:38 am
Shourjo
(@shourjo)
New Member

Hi,
Acquisition hashes are calculated to uniquely identify the data. However, verification hashes are calculated to maintain the integrity of the acquired data. verification hashes ensure that the acquired image or data has not been modified by recalculation of the acquired image and verification.
Hope this resolves your query.

ReplyQuote
Posted : 09/02/2018 7:02 am
nightworker
(@nightworker)
Active Member

I thınk he asking the verification after first image at the same time.I always thinking why we are verifying aquistion hash.

ReplyQuote
Posted : 09/02/2018 7:12 am
hommy0
(@hommy0)
Member

The purpose of verification directly after acquisition (for me) provides that level of reassurance that the content of the evidence file matches that of the source media.
If we think that the acquisition hash is of the source media (from sector 0 to sector N), this just tells us the "fingerprint" of that device.
The verification has relates to the content within the evidence file as has been acquired, hence this needs to be a direct replica of the source (exhibit).

To calculate verification hash directly after acquisition informations the examiner that they have a good and accurate "copy" of the exhibit media.

Think that the original media may not been retained for many reasons, you will need to be confident before handing back the original that the acquisition is a true and accurate copy - since you may not have the luxury of reacquiring the original at future point in time.

I certainly have had acquisitions where the acquisition and verification hashes have not matched (immediately after acquisition).

ReplyQuote
Posted : 09/02/2018 9:14 am
jaclaz
(@jaclaz)
Community Legend

Why there need to be a verification hash. Isn’t acquisition hash enough ?
What is the real benefit of verification hash.

In a nutshell, the acquisition hash represents the data read from the "original", the verification hash represents the data as written to the "image" (or clone), or even more properly, the data read from the "image" once it was written.

See
https://www.forensicfocus.com/Forums/viewtopic/t=11739/

jaclaz

ReplyQuote
Posted : 09/02/2018 11:09 am
Share: