Hashing is a method for reducing large inputs to a smaller fixed size output. When doing forensics, typically cryptographic hashing algorithms like MD5 and SHA-1 are used. These functions have a few properties useful to forensics. Other types of hashing, such as Context Triggered Piecewise Hashing can also be used.
There are literally hundreds of hashing programs out there, but a few related to forensics are:
- md5sum - Part of the GNU coreutils suite, this program is standard on many computers.
- md5deep - Computes hashes, recursively if desired, and can compare the results to known values.
- ssdeep - Computes and matches Context Triggered Piecewise Hashes.
Hash Lookup Services
There are several online services that you