DOJ currently only requires MD5 hash as sufficient. If you want to future proof a little, then SHA-1 and 256.
In my work, the software I use makes MD5/SHA1 automatically. Works for me, in order to invalidate my evidence you would have to break both algorithms on the SAME file.
To my knowledge, the eggheads have not done that yet. Please correct me if I am mistaken anyone. Preferable with a link.
Can any Australian members comment on whether this ruling back in 2005 has had any ongoing influence?
The NSW Roads and Traffic Authority (RTA) concedes that a court's decision to throw out a traffic infringement case had created "some uncertainty" about speed camera detection.
…
…
RTA lawyers told the court they could not find an expert to prove the authenticity of mathematical algorithms published on each picture.The algorithms known as MD5 are used as a security measure to prove the pictures have not been altered after they are taken.
Link
Aussie and although living in the US I'm au-fait with Oz law and was working LEO forensics in another state in Oz when that case occurred. That case doesn't prove anything other than if you don't have your witnesses lined up, don't bother going to court. I don't see in the article that it was dismissed with prejudice, which means that the govt can get their ducks in a row and do over.
And back to the MD5 issue as posted
Hashing has 2 functions in forensics validating your images haven't broken / been tampered; and KFF. There is no protection in the world that's going to defend you against a malicious examiner, especially not MD5, since if one were to plant or falsify evidence, they would merely need to do so before the initial hash. MD5 is more a check that your images haven't been corrupted, requiring the examiner to go back to their original image and re-make another working image. As for KFF, only an idiot would submit evidence based purely upon a match and not hit it with a Mark 1 Eyeball.
Hashing is always in my experienced combined with another method to verify, e.g. source hash with a good chain of custody process, and KFF with a visual inspection, meaning that more than a possible exploit of the MD5 algorithm is needed to invalidate it.