Cryptographic Hash Values

A cryptographic hash value is a fixed-length digital fingerprint generated from a file, storage medium or other digital data by a mathematical algorithm. Because even a minute change normally produces a substantially different value, hashes provide strong evidence of data integrity, meaning that the examined data remains unchanged from a recorded reference state.

How integrity verification works

Investigators first calculate and record a hash when digital evidence is collected or a forensic copy is created. The same algorithm is applied again whenever the evidence is transferred, stored or examined.

• If the later and original hash values match, this strongly supports that the bit-level contents have remained unchanged.
• If the values differ, the evidence has been altered or corrupted, although the hash alone does not identify when, why or by whom.
• Recording hashes at successive stages strengthens the chain of custody by providing repeatable checks on each copy.

Properties that make hashing useful

A suitable cryptographic hash function is deterministic, computationally one-way and resistant to collisions.

• Determinism means that identical input processed by the same algorithm always produces the same digest.
• Pre-image resistance makes reconstruction of the original data from its hash computationally impracticable.
• Collision resistance makes it computationally impracticable to find two different inputs with the same hash.

Evidentiary value and limitations

Under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023, the certificate framework for electronic records includes recording the hash value and the algorithm used.

• A hash authenticates the continuity of data only from the point at which the reference hash was reliably generated.
• It does not by itself prove authorship, ownership, truthfulness, lawful collection or freedom from manipulation before hashing.
• Integrity assurance depends on secure acquisition, documented custody and a suitably strong cryptographic algorithm; weak or compromised algorithms reduce reliability.