WEBVTT

0:00:03.160000 --> 0:00:07.080000
 In this video, we are going to calculate
 hashes for the evidence files

0:00:07.080000 --> 0:00:12.320000
 we gather. Hashes are very important
 when it comes to evidence, and it

0:00:12.320000 --> 0:00:15.460000
 is a way used by digital forensics
 to prove that evidence has not been

0:00:15.460000 --> 0:00:20.320000
 tampered. We also use it to check the
 integrity of the data we gather.

0:00:20.320000 --> 0:00:24.820000
 We will calculate hashes using a
 tool which is called hashcalc.

0:00:24.820000 --> 0:00:28.240000
 Hashcalc is a free tool that you can
 download, and it is used to calculate

0:00:28.240000 --> 0:00:29.120000
 different hashes.

0:00:29.120000 --> 0:00:32.720000
 In other words, it could be used to
 calculate hashes based on different

0:00:32.720000 --> 0:00:39.040000
 hashing algorithms, like
 MD5, SH1, SH512, etc.

0:00:39.040000 --> 0:00:42.120000
 The benefit of using more than one hashing
 algorithm is not only so that

0:00:42.120000 --> 0:00:45.960000
 it can be 100% sure of your evidence's
 integrity, but also, different

0:00:45.960000 --> 0:00:48.840000
 courts might accept
 specific hashes.

0:00:48.840000 --> 0:00:52.320000
 Calculating hashes for files is very
 important to perform, especially

0:00:52.320000 --> 0:00:56.680000
 when you want to calculate the values
 for evidence you acquire.

0:00:56.680000 --> 0:00:59.500000
 Let's go ahead and start the
 tool so we can use it.

0:00:59.500000 --> 0:01:03.780000
 It's a simple tool to use, and doesn't
 require much of configuration.

0:01:03.780000 --> 0:01:08.120000
 As you can see, it has most of the hashing
 algorithms out there, and all

0:01:08.120000 --> 0:01:11.960000
 you need to do is select the hashing
 algorithm you want to calculate.

0:01:11.960000 --> 0:01:14.280000
 I'll leave all the defaults as is.


0:01:14.280000 --> 0:01:18.780000
 In preparation for this video, I have
 created a folder with files in them.

0:01:18.780000 --> 0:01:21.220000
 Let's calculate the values
 for the files here.

0:01:21.220000 --> 0:01:25.160000
 All we need to do is drag and drop the
 file on top of the hash-calc tool,

0:01:25.160000 --> 0:01:28.140000
 and the tool will automatically calculate
 the hashes selected for the

0:01:28.140000 --> 0:01:29.900000
 file of interest.

0:01:29.900000 --> 0:01:34.220000
 Let's select SHA512 to be calculated
 as well, and then click the calculate

0:01:34.220000 --> 0:01:41.040000
 button. As you can see, we now have
 the results for MD5, SH1, SH512, and

0:01:41.040000 --> 0:01:45.460000
 CRC32. Let's test another file.

0:01:45.460000 --> 0:01:49.080000
 Like before, we'll just drag and
 drop the file on top of the tool.

0:01:49.080000 --> 0:01:52.100000
 As soon as the file is dropped, the
 hash-calc tool will automatically

0:01:52.100000 --> 0:01:57.360000
 calculate the hashes for the file based
 on the hashing algorithm selected.

0:01:57.360000 --> 0:02:01.680000
 All we need to do now is gather the hashes
 of these evidence files, create

0:02:01.680000 --> 0:02:04.860000
 a simple file, and copy
 the hashes to it.

0:02:04.860000 --> 0:02:06.800000
 You can name the file
 whatever you like.

0:02:06.800000 --> 0:02:16.520000
 For this video, I'll name
 the file hashes.txt.

0:02:16.520000 --> 0:02:20.340000
 Now we need to copy the file hashes
 from hash-calc to our simple text

0:02:20.340000 --> 0:02:25.100000
 file. Let's write the file name first,
 and then beneath it, add each hashing

0:02:25.100000 --> 0:02:29.120000
 algorithm and the value that the
 hash-calc calculated for us.

0:02:29.120000 --> 0:02:33.960000
 Let's copy the MD5
 hash value first.

0:02:33.960000 --> 0:02:40.980000
 Now let's add the SHA1 value,
 so let's copy it too.

0:02:40.980000 --> 0:02:44.560000
 Repeat that process, copying the values
 for all the hashes you calculated

0:02:44.560000 --> 0:02:47.560000
 and want to add to your report.

0:02:47.560000 --> 0:02:50.520000
 We can also use hash-calc to calculate
 the hashes for our forensic images

0:02:50.520000 --> 0:02:52.200000
 that we created.

0:02:52.200000 --> 0:02:55.920000
 We can simply drag and drop the image
 on top of the hash-calc tool.

0:02:55.920000 --> 0:03:00.140000
 As you can see, the tool is busy calculating
 the values for us, especially

0:03:00.140000 --> 0:03:03.560000
 now that it needs to calculate the hashes
 for four different hashing algorithms

0:03:03.560000 --> 0:03:10.320000
 and for a really big file, our forensic
 image that we acquired.

0:03:10.320000 --> 0:03:15.380000
 This concludes the video lesson on creating
 hash values for evidence files.

0:03:15.380000 --> 0:03:16.160000
 Thank you for joining us.