Hello. Welcome back to the Computer Forensics Path.
In this course, Course 12,
we're going to talk about hash values and file hashing.
In this course, we're going to
cover: understanding the concept of hashing,
the functions and uses of hashing,
creating hash sets, what
rainbow tables are and how
we use them to break passwords,
and we're going to cover hashing files,
folders and entire drives.
I know we have hash and drives in our imaging section,
but we're going to dive deeper into what
hash values are and other uses for them.
In Module 1, we're going to talk about
the function and the uses of hashing.
What is hashing?
Well, hashing is a way to represent data with
a unique numerical value using a mathematical algorithm.
It's like fingerprinting our data,
and that fingerprint is for
a specific dataset at a specific time.
Hash value of a dataset will change if it is modified,
or sometimes even if it is just opened up
in Windows without write protection.
You need to understand that
hashing is a one-way function.
We can get a hash value using a dataset,
but we cannot take that hash value and
then recreate the data from the hash.
The concept of hashing.
Regardless of what the size of the data is,
whether it's a megabyte or a gigabyte,
it doesn't matter, how
large or small the file
or the drives that you're hashing.
The hash algorithm size will not change.
If you're doing an MD5 hash,
that's going to be a 32-character value,
no matter what size the data is that
we're getting that hash value from.
The same is true for SHA1 and SHA256.
SHA1 is a 40-character value,
and that will never
change no matter what the size of the data is.
SHA256 is a 64-character long hash value,
and again, that will not change no matter how
big or small the dataset is that we are hashing.
What do we use hashes for?
Well, some of the common uses of
hashes is to check the integrity of
data as it is being sent from
one computer to another, like data transmission.
It is used for sector checking.
As we saw with reuse or a checksum 64 to
validate that our drives was properly wiped.
Also find integrity to
show that no changes were made to a file.
A hash value can show that
a file has not been changed because if changes were made,
the hash value would change.
We used it when we
validated our hard drives and we validated
our copies of our hard drives in the last course.
Well, let's talk about the MD5 collision for a second.
It was created in the laboratory.
The odds that two different files will have
the same MD5 hash value is two raised to the 128th power,
which is 3.4 undecillion.
That is rare than two people having
the same DNA or fingerprints.
In our next module,
we're going to talk about creating hash sets,
why we create hash sets,
and what we can use hash sets for.