An Empirical Study Illustrating Effects on Hash Value Changes in Forensic Evidence Appreciation

Abstract

The process of digital forensics consists of the collection, preservation, analysis, and presentation of digital evidence in the court of law. During this process integrity of evidence plays a major role in the admissibility of evidence. A hash value is the only way to determine the integrity of evidence. MD-5 and SHA-1 are used commonly functions in the forensic fraternity. Many types of research have been done on the collision of MD-5 and SHA-1 hash function. This illustrates that two different files having different content can have the same hash value. It is demonstrated that without manipulating any content of a file, the hash value may change. Considering this fact author has identified parameters that affect changes in the hash value. The author setup different scenarios and elucidated in what manner hash value may vary without alteration of content and also compared resultant hash value in .doc and .txt files respectively in the same condition.