Digital Forensics 101: Hashing
Digital Forensics 101: Hash your forensic images / files. Let's not forget the basics. It's important to hash your forensic images and files to generate hash values. Then when you copy those images / files somewhere else (oh, I don't know, perhaps to another HDD for discovery) make sure to hash those files again to make sure the hashes still match. Finally, provide the hash values to whoever you are providing said files to so they can verify the hash values. This is especially important when the hash values are not contained within the forensic image or any logs that are automatically generated or provided. On another note let's talk about why it's so important to generate hash values... Any guesses? If you answered "to maintain and verify the integrity of evidence," you win! Remember, the goal of what we're doing is to find and explain the facts of the case. You can't share the facts if you can't get your evidence admitted. You can't g...