Notifications
Clear all

Hashing an evidence

4 Posts
4 Users
0 Reactions
1,107 Views
(@mightywarrior)
New Member
Joined: 10 years ago
Posts: 3
Topic starter  

Hi,

Had a query with regard to taking the hash when an HDD/device is taken as an evidence. As part of evidence processing, we would take a bit-bit image of the HDD/device and also take a hash of that device as well. And all the investigation would be done on the imaged copy and not on the sourced copy.
Now my question is while taking an image and hash of the HDD/device, will the hash value get changed if it is taken again on the original device.
If yes, then how can we substantiate in a court stating that it is the same HDD/device.

Thanks in advance


   
Quote
(@Anonymous 6593)
Guest
Joined: 17 years ago
Posts: 1158
 

Now my question is while taking an image and hash of the HDD/device, will the hash value get changed if it is taken again on the original device.

If you're imaging off-line, and if you're using a write-blocker that works, nothing should change. However … normal HDD storage is not permanent. It may change due to magnetic decay (a hard drive should not be left disconnected for much more than a year, for example), or due to mechanic problems or electronic malfunction or for other reasons. There is no guarantee that the next person that images the same drive will get an image with the same hash.

The hash doesn't really serve to identify the device that was imaged, but to identify the original image, if there is later doubt that the images being analyzed isn't a good copy of the original.

If image hashes don't match, it's an indication that a closer investigation must be made what has changed?

If yes, then how can we substantiate in a court stating that it is the same HDD/device.

Depends on the court. Typically, that's covered by other means, such as chain of custody or similar methods. As hash will not really help you assert that 'this is the same HDD that was found in the suspect's computer', only that 'the content of this HDD is the same as that found in a HDD taken from the suspect's computer.'

For identity of physical device you need some kind of physical description manufacturer, device type and version, serial numbers, perhaps jumper settings, etc. A photo of the label may help, for example.


   
ReplyQuote
MDCR
 MDCR
(@mdcr)
Reputable Member
Joined: 15 years ago
Posts: 376
 

Worth watching on the subject
Skydogcon Think Different About Forensics - MD5 Hashing


   
ReplyQuote
mokosiy
(@mokosiy)
Trusted Member
Joined: 13 years ago
Posts: 55
 

I would also add it's always more than good if you could save SMART table before and after imaging session. This way you'd be able to prove differences in evidence drive state if it was changed.


   
ReplyQuote
Share: