1

Let's say a hard disk (A) is retrieved from a system to make a clone of it on hard disk (B) and use this clone for a forensic investigation.

  1. Is SHA-1 secure enough to make sure that no other information will be added to the cloned hard disk that can incriminate a person?

  2. What are the steps to consider in the process of cloning a hard drive to be at least 99% sure that forensic expertise is correct and no other evidence can be added in the process of the investigation. How to make sure that SHA1 hash of the drive A actually belongs to this drive and it's not a random hash that later can be referenced as the right one and used also in the cloned disk B.

  3. Considering that drive A will not be sealed no more, can someone add files to both hard disks while preserving the same sha-1 value on both hard disks and use the added materials as evidence in court?

Improve this question

1 Answer 1

Reset to default
3

If we assume that a hash is calculated based on the drive contents, and that we trusted the drive contents to be authentic at the time of hashing, then what you're worried about is some manner of hash collision (where two different pieces of data produce the same hash).

Currently, SHA-1 attacks are only theoretical, but there's a potential they could become viable in the not-too-distant future. MD5 collisions involving SSL certificates have been demonstrated in 2008, and although MD5 is weaker than SHA-1, SHA-1 is considered weaker than the modern recommendations.

In your case, you could improve confidence by using one of the SHA-2 algorithms, such as SHA-256 or SHA-512. Or even multiple hashes; if you can afford to compute several hashes, then that would increase the difficulty of producing a useful collision.

Also, if you plan on using hashes to verify that the contents of a drive haven't been tampered with, it is vitally important that the original hash must be done in a manner that is considered trustworthy. The original hash is basically your "seal of authenticity", as it were.

Improve this answer
3
  • "the original hash must be done in a manner that is considered trustworthy" - could you explain this a bit more please?
    – rmagnum2002
    Jul 23, 2015 at 10:04
  • The hash must be computed in a way that the court would accept as tamper-free, and then it must be stored by a trusted party. For instance, if you don't trust the forensics investigator to not tamper with the drive, then don't let them compute the hash without supervision. Exactly what constitutes "trustworthy" will depend on your situation, and is probably more about local law than about infosec - especially if courts are involved.
    – Soron
    Jul 23, 2015 at 10:40
  • Note that SHA-1 attacks are no longer just theoretical.
    – forest
    Jun 5, 2018 at 3:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .