Nowadays, technology is changing as fast as the speed of light but people are still unaware of new changes or innovations that are taking place. So, in this post, we are going to discuss the Hash value and will find out the answer of a question “Is Hash value valid for mobile phone or is it only valid for a HDD?”. Let’s check out whether it’s answer is “Yes” or “No” with the help of this write-up.
A Glimpse on Hash Value and Hashing
Most of the people have heard the word “Hash Value” but still they don’t know meaning and significance of hash value. One can say that Hash values are like fingerprints for files. The data of a file is processed through a cryptographic algorithm and a unique numerical value is produced known as the Hash value that identifies the data of a file. Basically, a hash is usually a hexadecimal string of several characters. If there is any modification in the data of a file then hash values will also change significantly. In other words, the Hash value can be defined as a string value, which is the result of calculation of Hashing Algorithm. The most commonly used hashing algorithms are MD5 and SHA. Hash values have different uses and one of its main use is to determine the integrity of any data.
Now, if a user is transferring a file from one computer to another, then how will he/she ensure that the copied file is same as the source file? For this one method is used called hashing, in this process information about the file is translated into a code. Then two hash values, one of the source file and other of the copied file will originate after hashing. Then the user can easily compare hash values of both the file to ensure the files are equal.
Benefits of Hashing
- One can compare different files without opening them by calculating the hash values of these files
- To verify the integrity of a file
- Encrypted file may be designed to never change the size of the file nor the last modification date and time. In such cases, it would be impossible to tell just by looking at the files whether they are similar files or different but via hash values, one would be able to tell about the files.
Role of Hash Value in Digital Devices
After knowing about Hash values and Hashing, let us find out why hash values are important. Rapid growth has experienced in the field of Digital Forensics in the recent years. Digital forensic is used to investigate computerized crimes, such as network intrusion, fabrication of data etc. Moreover, it is also used to investigate the crime where evidence is stored in any digital format on any digital device. The data acquisition step that is “the task of collecting digital evidence from electronic media” is performed during the digital forensic investigation. In this step, an exact copy of the evidence disk or file is created and referred as a forensic copy. While the other investigation takes place, to make sure that forensic copy is same as the original, hash value plays an important role in proving the accuracy of digital data at the time of the forensic investigation.
Hash value valid for a mobile phone or is it only valid for a HDD (Deadbox)
After reading the above section we got to know that hash value plays an important role in proving the accuracy of digital data but know the question arises “Is Hash value valid for a mobile phone or is it only valid for a HDD (Deadbox)?”. So, to under the understand the answer to this question one must understand the HDD “Dead box” approach and mobile phone approach.
HDD “Deadbox” Approach vs Mobile Phone Approach
Sometimes, investigators approach computer system that is not running (“dead”) and in most of the criminal cases, these computers are not to be turned on by the responding investigator, but instead, they are imaged using write protection to the evidence hard drive. To create a dead box image hard drive is removed and connected to a hardware write blocker. Along with the hardware write blockers, software developed to create forensic images is used to read or copy the evidence data. To make sure that original data is unchanged hash values are used to compares the files. Therefore, the hash value is valid for a HDD (Deadbox). On the other hand, when a mobile is seized from a crime location, first of all, it is kept in a Faraday bag which prevents the outside signal and also protects the integrity of data. If the mobile phone is in a live state while collecting evidence, hash values change frequently. As in mobile phone, there is file level hashing in which hash values system files changes every time. So, in case of mobile phone, it is difficult nearly impossible that hash values remain unchanged. So, from the above theory, one can conclude that Hash values are only valid for a HDD (Deadbox) not for mobile phone.
Final Words
So, after reading this write-up one will be able to know about Hash values and why they are important for Digital forensic. Moreover, we can also conclude the answer to our question asked at the beginning of this post which is “No, the hash value is only valid for HDD (Deadbox)”.
0 comments:
Post a Comment