1 1 00:00:00,510 --> 00:00:01,800 Hashing. 2 2 00:00:01,800 --> 00:00:02,888 Now, I've mentioned a couple times 3 3 00:00:02,888 --> 00:00:05,910 the idea of a hash or a hash digest 4 4 00:00:05,910 --> 00:00:08,760 and this is an important concept that we have to cover. 5 5 00:00:08,760 --> 00:00:10,170 Now, if you've taken security plus, 6 6 00:00:10,170 --> 00:00:12,390 this lesson is going to be a review for you, 7 7 00:00:12,390 --> 00:00:14,790 but that's okay, because it's really that important 8 8 00:00:14,790 --> 00:00:16,020 when you're dealing with digital forensics 9 9 00:00:16,020 --> 00:00:18,150 to ensure you have a good hash. 10 10 00:00:18,150 --> 00:00:21,120 When you look at a hash, all it is is a digital fingerprint. 11 11 00:00:21,120 --> 00:00:24,210 It identifies uniquely a file, a folder, 12 12 00:00:24,210 --> 00:00:28,590 a drive image or anything like that using this unique hash. 13 13 00:00:28,590 --> 00:00:30,900 Now, a hash is just a cryptographic function 14 14 00:00:30,900 --> 00:00:33,360 and it converts an arbitrary length string input 15 15 00:00:33,360 --> 00:00:35,730 into a fixed length string output. 16 16 00:00:35,730 --> 00:00:37,740 And there's a couple of different hashes out there. 17 17 00:00:37,740 --> 00:00:39,780 Things like SHA and MD5, 18 18 00:00:39,780 --> 00:00:41,070 and we're going to talk about both of those 19 19 00:00:41,070 --> 00:00:42,780 as we go through this lesson. 20 20 00:00:42,780 --> 00:00:44,520 Now, the first one I want to talk about is SHA, 21 21 00:00:44,520 --> 00:00:46,770 because it is the standard these days. 22 22 00:00:46,770 --> 00:00:49,230 SHA is the secure hash algorithm 23 23 00:00:49,230 --> 00:00:51,450 and this is a cryptographic hashing algorithm 24 24 00:00:51,450 --> 00:00:53,310 that was created to address the possible weakness 25 25 00:00:53,310 --> 00:00:56,880 in older algorithms, like the MD5 hashing algorithm. 26 26 00:00:56,880 --> 00:01:00,900 Unlike the older MD5, SHA-1 uses a larger bit size. 27 27 00:01:00,900 --> 00:01:02,160 So if you're using SHA-1, 28 28 00:01:02,160 --> 00:01:04,920 it's going to have 160 bit hash digest. 29 29 00:01:04,920 --> 00:01:07,980 But SHA-1 isn't really considered strong these days. 30 30 00:01:07,980 --> 00:01:10,260 It was at the time when it came out in 1995, 31 31 00:01:10,260 --> 00:01:12,870 but computers change and things get weaker over time 32 32 00:01:12,870 --> 00:01:14,520 as computers get stronger. 33 33 00:01:14,520 --> 00:01:16,650 So instead, they brought out SHA-2. 34 34 00:01:16,650 --> 00:01:21,360 SHA-2 uses a 256 bit or 512 bit hash digest 35 35 00:01:21,360 --> 00:01:22,530 and it is the current version 36 36 00:01:22,530 --> 00:01:25,200 that's used in all of modern forensics. 37 37 00:01:25,200 --> 00:01:26,880 Now, before that was most popular, 38 38 00:01:26,880 --> 00:01:29,370 we used to use something called MD5. 39 39 00:01:29,370 --> 00:01:32,310 MD5 is the Message Digest Algorithm. 40 40 00:01:32,310 --> 00:01:34,410 Now, this was a cryptographic hashing algorithm 41 41 00:01:34,410 --> 00:01:36,720 created all the way back in 1990. 42 42 00:01:36,720 --> 00:01:38,550 So over 30 years ago 43 43 00:01:38,550 --> 00:01:41,130 and MD5 was the most commonly used variant 44 44 00:01:41,130 --> 00:01:43,470 inside the Message Digest Algorithm. 45 45 00:01:43,470 --> 00:01:45,390 So you might hear it called the MDA, 46 46 00:01:45,390 --> 00:01:49,410 for Message Digest Algorithm, or more specifically, MD5, 47 47 00:01:49,410 --> 00:01:51,450 which is the one that we use most of the time. 48 48 00:01:51,450 --> 00:01:52,740 Now, the problem with MD5 49 49 00:01:52,740 --> 00:01:55,830 is that it uses 128 bit hash digest. 50 50 00:01:55,830 --> 00:01:57,660 This makes it susceptible to collisions 51 51 00:01:57,660 --> 00:01:59,250 and therefore it should only be used 52 52 00:01:59,250 --> 00:02:01,860 as a second factor of integrity checking. 53 53 00:02:01,860 --> 00:02:03,840 Now, what do I mean by a collision? 54 54 00:02:03,840 --> 00:02:07,050 Well, a collision occurs when two of those random values 55 55 00:02:07,050 --> 00:02:10,320 that we input into an algorithm give us the same output. 56 56 00:02:10,320 --> 00:02:12,690 Remember, we said that all of these hash digests 57 57 00:02:12,690 --> 00:02:14,580 can take a random input. 58 58 00:02:14,580 --> 00:02:16,920 So whether I give them a word, a sentence, 59 59 00:02:16,920 --> 00:02:19,590 a paragraph, a book, or a library, 60 60 00:02:19,590 --> 00:02:21,750 I'm still only going to get the hashtag digest 61 61 00:02:21,750 --> 00:02:23,160 that's the same value. 62 62 00:02:23,160 --> 00:02:26,430 So in this case, for MD5, it's only 128 bits. 63 63 00:02:26,430 --> 00:02:28,650 Now, that means there's only so many possibilities 64 64 00:02:28,650 --> 00:02:30,480 and eventually there's going to be two things 65 65 00:02:30,480 --> 00:02:32,130 that give you the same output. 66 66 00:02:32,130 --> 00:02:34,230 That's what a collision is, and we want to avoid those, 67 67 00:02:34,230 --> 00:02:36,780 because collisions mean we can have multiple files 68 68 00:02:36,780 --> 00:02:38,370 having the same digital fingerprint, 69 69 00:02:38,370 --> 00:02:41,130 and that would be bad, especially in forensics. 70 70 00:02:41,130 --> 00:02:42,480 So you may be asking yourself, 71 71 00:02:42,480 --> 00:02:44,850 what tools can actually create these hash values 72 72 00:02:44,850 --> 00:02:46,740 and calculate them for us? 73 73 00:02:46,740 --> 00:02:49,170 Well, I already mentioned the fact that NKs and FTK 74 74 00:02:49,170 --> 00:02:51,570 will do this during your image acquisition for you, 75 75 00:02:51,570 --> 00:02:53,970 but there's lots of other ones you can use too. 76 76 00:02:53,970 --> 00:02:55,860 For instance, in the Windows Operating System, 77 77 00:02:55,860 --> 00:02:58,710 there is a built-in command known as CertUtil 78 78 00:02:58,710 --> 00:03:01,890 CertUtil is a built-in command where you can give it a file 79 79 00:03:01,890 --> 00:03:03,330 and tell it what algorithm you want, 80 80 00:03:03,330 --> 00:03:07,830 such as MD5, SHA-1, SHA-256 or SHA-512, 81 81 00:03:07,830 --> 00:03:10,020 and it will give you that hash digest. 82 82 00:03:10,020 --> 00:03:11,100 Another one you can use 83 83 00:03:11,100 --> 00:03:15,420 is the File Checksum Integrity Verifier, or FCIV. 84 84 00:03:15,420 --> 00:03:17,760 This is a downloadable utility that you can use 85 85 00:03:17,760 --> 00:03:19,860 as an alternative to CertUtil and again, 86 86 00:03:19,860 --> 00:03:21,180 it works on Windows. 87 87 00:03:21,180 --> 00:03:22,590 If you happen to be running Linux, 88 88 00:03:22,590 --> 00:03:24,810 there's lots of great utilities for this too, 89 89 00:03:24,810 --> 00:03:29,810 like md5sum, sha1sum, sha256sum, and sha512sum. 90 90 00:03:30,420 --> 00:03:31,500 All of these are tools 91 91 00:03:31,500 --> 00:03:33,600 to calculate those particular algorithms 92 92 00:03:33,600 --> 00:03:35,880 and giving you that particular hash digest. 93 93 00:03:35,880 --> 00:03:38,430 So with all that discussion around hashing, 94 94 00:03:38,430 --> 00:03:40,980 what do we really want to use hashing for? 95 95 00:03:40,980 --> 00:03:43,590 Well, it provides us with that digital fingerprint 96 96 00:03:43,590 --> 00:03:46,320 and so it can be used to prove file integrity 97 97 00:03:46,320 --> 00:03:49,320 of your operating system files and application files. 98 98 00:03:49,320 --> 00:03:51,690 This can be done using a software utility 99 99 00:03:51,690 --> 00:03:55,080 that includes File Integrity Monitoring, or FIM. 100 100 00:03:55,080 --> 00:03:57,660 This is a type of software that reviews your system files 101 101 00:03:57,660 --> 00:03:59,760 to ensure they haven't been tampered with. 102 102 00:03:59,760 --> 00:04:01,020 How do they do this? 103 103 00:04:01,020 --> 00:04:03,300 Well, when you install some kind of software, 104 104 00:04:03,300 --> 00:04:05,370 for instance, the Windows Operating System, 105 105 00:04:05,370 --> 00:04:07,680 Microsoft gives you a list of authorized 106 106 00:04:07,680 --> 00:04:10,500 and approved hash values for those files. 107 107 00:04:10,500 --> 00:04:12,990 Anytime the File Integrity Monitoring program thinks 108 108 00:04:12,990 --> 00:04:14,490 that the file may have changed, 109 109 00:04:14,490 --> 00:04:16,200 it can run a hash on that file, 110 110 00:04:16,200 --> 00:04:18,330 compare it to the known good file hash 111 111 00:04:18,330 --> 00:04:19,470 and if they don't match, 112 112 00:04:19,470 --> 00:04:21,150 that will be flagged as something bad, 113 113 00:04:21,150 --> 00:04:23,580 because somebody has modified this file. 114 114 00:04:23,580 --> 00:04:25,950 This is a great way to check if some kind of malware 115 115 00:04:25,950 --> 00:04:27,960 has modified system files for you 116 116 00:04:27,960 --> 00:04:29,880 for any of your known applications. 117 117 00:04:29,880 --> 00:04:32,100 This can also be done against your data files too, 118 118 00:04:32,100 --> 00:04:34,230 although it's a lot less common in that regard. 119 119 00:04:34,230 --> 00:04:36,420 Some third party utilities may also do this 120 120 00:04:36,420 --> 00:04:38,040 for different data files as well, 121 121 00:04:38,040 --> 00:04:39,360 but it's a lot less common. 122 122 00:04:39,360 --> 00:04:41,130 Most of the time you're going to see this used 123 123 00:04:41,130 --> 00:04:43,473 against system files and application files.