This will show you how to understand what the hash function is and how to investigate it in different ways.

What are the most popular hash functions?

  • The most common hash functions used in digital forensics are Message Digest 5 (MD5), and Secure Hashing Algorithm (SHA) 1 and 2.
Hash functionsProvide a brief overview of each oneExampleHow big a hash value do they produce? (Digest size /length)
Message Digest 5 (MD5)The MD5, defined in RFC 1321, is a hash algorithm to turn inputs into a fixed 128-bit (16 bytes) length of the hash value.

MD5 is not collision-resistantTwo different inputs may producing the same hash value
Text: goodbyeMyfriend888

Hash message: 0ea6c58190e34e9a23ccb0de1df8a77d
128 bits
Hashing Algorithm (SHA) – 1a cryptographic hash function which takes an input and produces a 160-bit (20-byte) hash value. This hash value is known as a message digest. This message digest is usually then rendered as a hexadecimal number which is 40 digits long.Phrase: Go Steelers!

Hash message: c924 4cac 47b3 4335 5aed 06f3 cc85 ea82 885f 9f3e
160 bits
Hashing Algorithm (SHA) – 2They are built using the Merkle–Damgård construction, from a one-way compression function itself built using the Davies–Meyer structure from a specialized block cipher.

It’s a family of functions with different output size
Text: helloAbcdefg17

Hash message: 7fdbb09efef10cc600b05f87a838919d73e5ffcabee3525e60c57c0258478b33
224, 256(SHA-256), 384, or 512 bits
The table can show you details about 3 different popular hash functions.