What is a cryptographic hash function and why is it used in forensics?

• A. A function that outputs a fixed-length digest from input data; used to verify file integrity, detect changes, and generate evidence identifiers.
• B. An encryption method used to hide data.
• C. A tool for compressing data.
• D. A random number generator.

Answer: (A)

A cryptographic hash function takes input data and produces a fixed-length digest that acts as a compact fingerprint of the content. The important idea is that the same input always yields the same digest, while any change to the input changes the digest. In forensics, this makes it possible to prove whether a piece of evidence has been altered: you calculate the hash when the evidence is collected and later recompute it to confirm the digest is unchanged. The digest also provides a compact, unique identifier for the file, which helps in organizing, referencing, and maintaining the integrity of the evidence in reports and during the chain of custody. The one-way nature and collision resistance of a good hash function further support forensics by making it impractical to reverse-engineer the original data from the digest and by making accidental or malicious collisions unlikely.

Hashes are not encryption, so they don’t hide data. They aren’t tools for compressing data, and they aren’t random number generators.