The Impact of MD5 File Hash Collisions On Digital Forensic Imaging

Gary C. Kessler

doi:10.15394/jdfsl.2016.1431

The Impact of MD5 File Hash Collisions On Digital Forensic Imaging

Gary C. Kessler

Security Studies & International Affairs

Research output: Contribution to journal › Article › peer-review

Abstract

The Message Digest 5 (MD5) hash is commonly used as for integrity verification in the forensic imaging process. The ability to force MD5 hash collisions has been a reality for more than a decade, although there is a general consensus that hash collisions are of minimal impact to the practice of computer forensics. This paper describes an experiment to determine the results of imaging two disks that are identical except for one file, the two versions of which have different content but otherwise occupy the same byte positions on the disk, are the same size, and have the same hash value.

Original language	American English
Journal	Default journal
DOIs	https://doi.org/10.15394/jdfsl.2016.1431
State	Published - Dec 31 2016

Keywords

MD5 hash collisions
forensic imaging
computer forensics
digital forensics

Disciplines

Computer Engineering
Computer Law
Computer Sciences
Electrical and Computer Engineering
Forensic Science and Technology
Information Security

Access to Document

10.15394/jdfsl.2016.1431License: CC BY

The Impact of MD5 File Hash Collisions On Digital Forensic ImaginFinal published version, 537 KBLicense: CC BY

Cite this

@article{d5a3442584054561aa28baa6cfb8e90a,

title = "The Impact of MD5 File Hash Collisions On Digital Forensic Imaging",

abstract = " The Message Digest 5 (MD5) hash is commonly used as for integrity verification in the forensic imaging process. The ability to force MD5 hash collisions has been a reality for more than a decade, although there is a general consensus that hash collisions are of minimal impact to the practice of computer forensics. This paper describes an experiment to determine the results of imaging two disks that are identical except for one file, the two versions of which have different content but otherwise occupy the same byte positions on the disk, are the same size, and have the same hash value.",

keywords = "MD5 hash collisions, forensic imaging, computer forensics, digital forensics",

author = "Kessler, {Gary C.}",

year = "2016",

month = dec,

day = "31",

doi = "10.15394/jdfsl.2016.1431",

language = "American English",

journal = "Default journal",

}

TY - JOUR

T1 - The Impact of MD5 File Hash Collisions On Digital Forensic Imaging

AU - Kessler, Gary C.

PY - 2016/12/31

Y1 - 2016/12/31

N2 - The Message Digest 5 (MD5) hash is commonly used as for integrity verification in the forensic imaging process. The ability to force MD5 hash collisions has been a reality for more than a decade, although there is a general consensus that hash collisions are of minimal impact to the practice of computer forensics. This paper describes an experiment to determine the results of imaging two disks that are identical except for one file, the two versions of which have different content but otherwise occupy the same byte positions on the disk, are the same size, and have the same hash value.

AB - The Message Digest 5 (MD5) hash is commonly used as for integrity verification in the forensic imaging process. The ability to force MD5 hash collisions has been a reality for more than a decade, although there is a general consensus that hash collisions are of minimal impact to the practice of computer forensics. This paper describes an experiment to determine the results of imaging two disks that are identical except for one file, the two versions of which have different content but otherwise occupy the same byte positions on the disk, are the same size, and have the same hash value.

KW - MD5 hash collisions

KW - forensic imaging

KW - computer forensics

KW - digital forensics

UR - https://commons.erau.edu/jdfsl/vol11/iss4/9

U2 - 10.15394/jdfsl.2016.1431

DO - 10.15394/jdfsl.2016.1431

M3 - Article

JO - Default journal

JF - Default journal

ER -

The Impact of MD5 File Hash Collisions On Digital Forensic Imaging

Abstract

Keywords

Disciplines

Access to Document

Other files and links

Cite this