SANS Advanced Incident Response, Threat Hunting, and Digital Forensics (FOR508) Practice test

Cryptographic hashes serve as fingerprints for digital evidence. They let you detect any change to data by producing a fixed-length fingerprint that uniquely represents the exact bytes at a given moment. In practice, you calculate a hash when you first collect the evidence, then re-calculate and compare hashes after imaging, transferring, or storing the data. If the hashes match, you have strong assurance that the copy or the preserved evidence is identical to the original, which is essential for maintaining the chain of custody and the integrity of analysis.

SHA-256 is the recommended primary algorithm because it offers strong collision and preimage resistance and is widely supported across tools and platforms. MD5 and SHA-1 have known vulnerabilities and are considered weak for security-sensitive work, so they should not be relied upon as the main integrity check. They may be kept only as legacy references to compare against older evidence sets, not as the sole verification method.

Using hashes this way clarifies exactly what was collected and when, supports reproducible verification by different investigators, and helps ensure that evidence remains untampered through all stages of handling.