Digital › Module 3 › Lesson 2
Hashing Integrity
Cryptographic hashes prove image integrity — record SHA-256 at intake and verify before analysis on $DFIR_LAB.
Visual · t26_hashing_integrity
Hash literacy. $DFIR_LAB only. Original Cyberlium.
Opening
Same bytes, same hash — different bytes, different case story. Hash before you trust.
MD5 and SHA-1 appear in legacy tools; SHA-256 is modern default for integrity verification. Hash the source at acquisition, hash the working copy after transfer, re-verify before export — any mismatch triggers stop-and-review. Cyberlium practices hash lines on YOUR $DFIR_LAB exhibits — compare course-published hashes when supplied — never dismiss mismatches as 'probably fine.' Next: Write Blockers.
1. When to hash (named)
At intake: original media or provided image. After copy: destination drive or E01 segment set. Before testimony/exhibit handoff: verify working copy still matches logged hash.
On $DFIR_LAB, paste a sample SHA-256 line (from course or self-generated on practice file) into notes — fictional values OK if labeled sample.
Command guide
Try these commands — When to hash (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Integrity verification — https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds
Optional command
OpenSSL dgst — https://www.openssl.org/docs/manmaster/man1/openssl-dgst.html (alternate hash tool literacy)
CISA IR — https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response
═══ INSTALL ═══
Linux (Debian/Ubuntu):
macOS:
Windows:
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}hash twice — demonstrate identical digest on unchanged file
Command — copy this
sha256sum "$LAB_DFIR/evidence/sample.bin" | tee "$LAB_DFIR/evidence/sample.bin.sha256" sha256sum -c "$LAB_DFIR/evidence/sample.bin.sha256" sha256sum "$LAB_DFIR/evidence/sample.bin" | grep -F "$(cut -d' ' -f1 "$LAB_DFIR/evidence/sample.bin.sha256")"
Primary tools to practice this lesson: sha256sum, grep. Reference sites: Integrity verification (https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds); OpenSSL dgst (https://www.openssl.org/docs/manmaster/man1/openssl-dgst.html); CISA IR (https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Verify vs identify
Verification: re-hash and compare to CoC value — detects accidental corruption or tamper. Identification: hash as exhibit label — not a security guarantee against intentional collision attacks at nation-state level, but standard practice.
Tool literacy: openssl dgst, hashdeep, Imager embedded verify — name a tool, do not need stranger hardware.
3. Mismatch response
Forbidden: continuing analysis when hash differs, or 'fixing' the image without documenting. Allowed: mismatch playbook — stop, preserve logs, notify lead, re-acquire from sealed original if policy allows.
Ship: hash log stub — algorithm, value placeholder, verify date UTC, tool name. Next: Write Blockers.
4. What you ship: hash log stub for $DFIR_LAB
SHA-256 line, verify date, tool name. $DFIR_LAB named. NEVER ignore mismatches. chmod 600.
5. What you record before the next lesson
Date. Hash log. $DFIR_LAB named. File t26-m03-l02-hashing-integrity.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip verify because image 'looks fine.' Change one byte and hide mismatch.
Right
Write hash log stub for YOUR $DFIR_LAB exhibit. Next: Write Blockers.
Mission: document hash discipline
1) Name preferred algorithm (SHA-256). 2) List three hash checkpoints. 3) Write mismatch stop rule. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Publish hash with exhibit ID — reviewers love matching lines.
Knowledge Check
APPLY: Hashing integrity supports:
Multiple choice
Knowledge Check
APPLY: True or False: You should stop and review if verification hash mismatches CoC.
True or False
Knowledge Check
APPLY: SHA-256 is primarily used here for:
Multiple choice