Which statement about hash functions is true in the context of digital forensics?

• A. SHA-256 is widely recommended due to better collision resistance
• B. SHA-3 is not used in digital forensics
• C. MD5 is deprecated due to collisions
• D. Hash functions replace digital signatures

Answer: (A)

Hash functions in digital forensics are used to create a unique fingerprint of evidence so you can later verify that the data hasn’t been altered. The key quality is collision resistance: it should be exceedingly unlikely for two different files to produce the same hash. That reliability is crucial for maintaining chain-of-custody and proving integrity across time and multiple analysts.

SHA-256, part of the SHA-2 family, is widely recommended because it offers strong collision resistance and is well-supported across forensic tools and workflows. This makes it a trusted default for generating and verifying evidence hashes in investigations.

MD5, while fast, has known weaknesses: collisions can occur, which undermines integrity checks. That’s why MD5 is deprecated for forensic use in favor of more secure options like SHA-256. SHA-3 exists and is usable in some contexts, but it isn’t as universally adopted as SHA-256 yet, so the blanket statement about not using SHA-3 isn’t accurate.

Hashes don’t replace digital signatures. They enable efficient signing and verification of data integrity, while signatures provide authenticity and non-repudiation.