Hashing and data Fingerprinting in digital Forensics

Some of the significant problems that need to be resolved to make 'hashing' an useful tool in digital forensic investigations, are discussed. Hashing of data can be used to validate data integrity and identify known content because of their high throughput and memory efficiency. A hash function can take an arbitrary string of binary data and produces a number, termed a digest, in a predefined patterns. Cryptographic hash functions like MD5, RIPEDMD-160, SHA-1, SHA-256, and SHA-512 are designed to be collision resistant and to produce 128- to 512-bit results. Hashing algorithms like checksums, polynomial hashes, and universal hashes have very limited use in digital forensics. Hashing can also help to efficiently and rapidly find versions of known objects, with which an inquiry can be narrowed. It can also be used to screen targets for trace evidence like remnants of a JPEG files, without depending on file system metadata.