Download PDF User Manual

Chapter 21 - Hash Sets
21.4 VERIFICATION HASH
A “verification hash” is a recalculation of the hash for a forensic image file. It enables
the investigator to compare the acquisition hash with the verification hash to confirm
the validity of the image file, i.e. if the hashes are identical; the image has not changed
since acquisition.
There are two methods to calculate verification hash in Forensic Explorer:
1.
Calculate the verification hash when adding evidence to the case:
a.
In the Evidence Module, start a case or preview or open an existing case.
b.
Click the Add Device, Add Image or Add File button to add evidence to
the case.
c.
In the Evidence Processor window, place a check in the “Verify Device
Hashes” box. Click Start to proceed with the evidence processing.
Figure 201, Evidence Processor
2.
Calculate the verification hash during a case:
a.
In the File System module, run the “Verify Device Hash” script accessed
from the Analysis Programs drop down menu:
Copyright GetData Forensics Pty Ltd 2010 - 2015, All rights reserved.
261 | P a g e