Abstract
While conducting a validation study of proficiency test media we found that applying the same hash algorithm against a single CD using different forensic applications resulted in different hash values. We formulated a series of experiments to determine the cause of the anomalous hash values. Our results suggest that certain write options cause forensic applications to report different hash values. We examine the possible consequences of these anomalies in legal proceedings and provide best practices for the use of hashing procedures.
Chapter PDF
Similar content being viewed by others
References
AccessData, Forensic Toolkit (http://www.accessdata.com).
CD Record (http://cdrecord.berlios.de/old/private/cdrecord.html).
G. D’Haese, The ISO 9660 file system (http://users.pandora.be/it3.consultants.bvba/handouts/ISO9960.html), 1995.
D. Eastlake and P. Jones, US Secure Hash Algorithm 1 (SHA1) (http://www.ietf.org/rfc/rfc3174.txt), 2001.
Guidance Software, EnCase (http://www.guidancesoftware.com).
Nero AG, Nero (http://www.nero.com).
R. Rivest, The MD5 message-digest algorithm (http://www.ietf.org/rfc/rfc1321.txt), 1992.
M. Shannon, Linux forensics (http://www.agilerm.net/linuxl.html), 2004.
Sony Electronics, What are CD-ROM Mode-1, Mode-2 and XA? (http://sony.storagesupport.com/cgi-bin/sonysupport.cgi/M1QyNUjPDA4dzatpCN5uJ=xjZSMlgW60/faq/view/413).
Wikipedia, ISO 9660 (http://en.wikipedia.org/wiki/ISO_9660).
Wikipedia, Optical disc authoring (http://en.wikipedia.org/wiki/Optical_disc_authoring).
Wikipedia, Optical disc recording modes (http://en.wikipedia.org/wiki/Disc_At_Once).
X-Ways Software Technology AG, X-Ways Forensics (http://www.x-ways.net).
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2007 International Federation for Information Processing
About this paper
Cite this paper
Marberry, C., Craiger, P. (2007). Factors Affecting One-Way Hashing of CD-R Media. In: Craiger, P., Shenoi, S. (eds) Advances in Digital Forensics III. DigitalForensics 2007. IFIP — The International Federation for Information Processing, vol 242. Springer, New York, NY. https://doi.org/10.1007/978-0-387-73742-3_10
Download citation
DOI: https://doi.org/10.1007/978-0-387-73742-3_10
Publisher Name: Springer, New York, NY
Print ISBN: 978-0-387-73741-6
Online ISBN: 978-0-387-73742-3
eBook Packages: Computer ScienceComputer Science (R0)