|
A hash value is a "digital fingerprint"
that uniquely identifies a file. Every file
has its own hash value that is unique to that file. To calculate a file's hash value,
a cryptographic hash function is run on the file. This function employs an algorithm
that computes a the hash value. There are many available hash functions. Two of
the most popular ones are MD5 and SHA.
When are hash values useful?
Hash values are used to compare the content of files. File names, file sizes, and
even visually inspecting the files (see
steganography)
are not enough to determine if two files are
identical. By computing a hash value for each file, we can then simply compare the
hash values. (Use
Quick Hash
to generate a variety of hash values for files.)
How do our products use hash values?
When
Forensic P2P
executes a search for a file, an SHA1 hash value is returned for each
search result. Forensic P2P can then send those hash values to your agency's database
of known illegal files to check for a match.
If a match is found that search result
will be brought to your attention.
Forensic Database
stores an SHA1 hash value for each file added to the database.
|