Hashing

From Forensics Wiki
Revision as of 19:59, 2 May 2006 by Uwe Hermann (Talk | contribs)

Jump to: navigation, search

Hashing is a method for reducing large inputs to a smaller fixed size output. When doing forensics, typically cryptographic hashing algorithms like MD5 and SHA-1 are used. These functions have a few properties useful to forensics.

Tools

There are literally hundreds of hashing programs out there, but a few related to forensics are:

  • md5sum - Part of the GNU coreutils suite, this program is standard on many computers.
  • md5deep - Computes hashes, recursively if desired, and can compare the results to known values.