Gordon Brown and Hash Values

With the General Election nearly upon us, my mind drifts back to the last one, and a certain TV debate where the three main contenders concluded by smiling at the camera. Two of them managed it, but Gordon Brown had severe difficultly and the image that came across onto millions of TV’s that night was… scary.

I remarked at the time that the image was so scary that it probably had its own hash value, which, when the intended laughs failed to materialise, got me thinking that either I wasn’t being funny (possible!), or people didn’t know what a hash value was.

So What Is A Hash Value ?
A hash value is a unique sequence of alphanumeric characters that can be used to identify a file and it’s contents. It’s generated by applying a complex algorithm to a file and the resultant alphanumeric sequence obtained is the hash value for that file. If the file never changes, neither will its hash value. The smallest change to a file (eg. by adding / subtracting / modifying a byte) will produce a completely different hash value. Duplicate files generate the same hash value even when the files are saved on different machines.

Hash values are used a lot in police work, particularly with indecent images. Once a set of indecent images has been identified, each image file can be assigned a hash value. The next time a computer is encountered containing indecent images, rather than open each image to check its contents, the new files are simply run through a program that obtains their hash values. These are then compared against a database of known hash values, and if a match is found, it is known that the same indecent image is also present on the newly seized computer.

Hashing files greatly speeds up evidence detection as files no longer need to be manually opened and checked. Hashing also removes the need for the examiner to view often upsetting images.

Links:
Data Clinic’s Computer forensics investigations section
More about hash values