Instructor: Hashing. 2 2
Now, I've mentioned a couple times 3 3
the idea of a hash or a hash digest 4 4
and this is an important concept that we have to cover. 5 5
Now, if you've taken security plus, 6 6
this lesson is going to be a review for you, 7 7
but that's okay, because it's really that important 8 8
when you're dealing with digital forensics 9 9
to ensure you have a good hash. 10 10
When you look at a hash, all it is is a digital fingerprint. 11 11
It identifies uniquely a file, a folder, 12 12
a drive image or anything like that using this unique hash. 13 13
Now, a hash is just a cryptographic function 14 14
and it converts an arbitrary length string input 15 15
into a fixed length string output. 16 16
And there's a couple of different hashes out there. 17 17
Things like SHA and MD5, 18 18
and we're going to talk about both of those 19 19
as we go through this lesson. 20 20
Now, the first one I want to talk about is SHA, 21 21
because it is the standard these days. 22 22
SHA is the secure hash algorithm 23 23
and this is a cryptographic hashing algorithm 24 24
that was created to address the possible weakness 25 25
in older algorithms, like the MD5 hashing algorithm. 26 26
Unlike the older MD5, SHA-1 uses a larger bit size. 27 27
So if you're using SHA-1, 28 28
it's going to have 160 bit hash digest. 29 29
But SHA-1 isn't really considered strong these days. 30 30
It was at the time when it came out in 1995, 31 31
but computers change and things get weaker over time 32 32
as computers get stronger. 33 33
So instead, they brought out SHA-2. 34 34
SHA-2 uses a 256 bit or 512 bit hash digest 35 35
and it is the current version 36 36
that's used in all of modern forensics. 37 37
Now, before that was most popular, 38 38
we used to use something called MD5. 39 39
MD5 is the Message Digest Algorithm. 40 40
Now, this was a cryptographic hashing algorithm 41 41
created all the way back in 1990. 42 42
So over 30 years ago 43 43
and MD5 was the most commonly used variant 44 44
inside the Message Digest Algorithm. 45 45
So you might hear it called the MDA, 46 46
for Message Digest Algorithm, or more specifically, MD5, 47 47
which is the one that we use most of the time. 48 48
Now, the problem with MD5 49 49
is that it uses 128 bit hash digest. 50 50
This makes it susceptible to collisions 51 51
and therefore it should only be used 52 52
as a second factor of integrity checking. 53 53
Now, what do I mean by a collision? 54 54
Well, a collision occurs when two of those random values 55 55
that we input into an algorithm give us the same output. 56 56
Remember, we said that all of these hash digests 57 57
can take a random input. 58 58
So whether I give them a word, a sentence, 59 59
a paragraph, a book, or a library, 60 60
I'm still only going to get the hashtag digest 61 61
that's the same value. 62 62
So in this case, for MD5, it's only 128 bits. 63 63
Now, that means there's only so many possibilities 64 64
and eventually there's going to be two things 65 65
that give you the same output. 66 66
That's what a collision is, and we want to avoid those, 67 67
because collisions mean we can have multiple files 68 68
having the same digital fingerprint, 69 69
and that would be bad, especially in forensics. 70 70
So you may be asking yourself, 71 71
what tools can actually create these hash values 72 72
and calculate them for us? 73 73
Well, I already mentioned the fact that NKs and FTK 74 74
will do this during your image acquisition for you, 75 75
but there's lots of other ones you can use too. 76 76
For instance, in the Windows Operating System, 77 77
there is a built-in command known as CertUtil 78 78
CertUtil is a built-in command where you can give it a file 79 79
and tell it what algorithm you want, 80 80
such as MD5, SHA-1, SHA-256 or SHA-512, 81 81
and it will give you that hash digest. 82 82
Another one you can use 83 83
is the File Checksum Integrity Verifier, or FCIV. 84 84
This is a downloadable utility that you can use 85 85
as an alternative to CertUtil and again, 86 86
it works on Windows. 87 87
If you happen to be running Linux, 88 88
there's lots of great utilities for this too, 89 89
like md5sum, sha1sum, sha256sum, and sha512sum. 90 90
All of these are tools 91 91
to calculate those particular algorithms 92 92
and giving you that particular hash digest. 93 93
So with all that discussion around hashing, 94 94
what do we really want to use hashing for? 95 95
Well, it provides us with that digital fingerprint 96 96
and so it can be used to prove file integrity 97 97
of your operating system files and application files. 98 98
This can be done using a software utility 99 99
that includes File Integrity Monitoring, or FIM. 100 100
This is a type of software that reviews your system files 101 101
to ensure they haven't been tampered with. 102 102
How do they do this? 103 103
Well, when you install some kind of software, 104 104
for instance, the Windows Operating System, 105 105
Microsoft gives you a list of authorized 106 106
and approved hash values for those files. 107 107
Anytime the File Integrity Monitoring program thinks 108 108
that the file may have changed, 109 109
it can run a hash on that file, 110 110
compare it to the known good file hash 111 111
and if they don't match, 112 112
that will be flagged as something bad, 113 113
because somebody has modified this file. 114 114
This is a great way to check if some kind of malware 115 115
has modified system files for you 116 116
for any of your known applications. 117 117
This can also be done against your data files too, 118 118
although it's a lot less common in that regard. 119 119
Some third party utilities may also do this 120 120
for different data files as well, 121 121
but it's a lot less common. 122 122
Most of the time you're going to see this used 123 123
against system files and application files.