Sherlock Forensics Hash Calculator Forensic File Integrity Verification

Cryptographic hashing is the foundation of digital evidence integrity. A hash function takes any file and produces a fixed-length value that is unique to that exact sequence of bytes. Change one bit in the file and the hash changes completely. This property makes hashing essential for three critical functions in forensic work.

Chain of Custody Verification

When digital evidence is collected, the examiner records the SHA256 hash of each file. At every subsequent transfer, the hash is recomputed and compared. If the hashes match, the evidence has not been altered. If they differ, the chain of custody is broken. Courts require this documentation to admit digital evidence. NIST Special Publication 800-86 (csrc.nist.gov) establishes these standards. Hash Calculator pairs with Sherlock Forensics Disk Imager for the post-acquisition image-verification step. Compute SHA256 of the acquired E01 or raw disk image with Hash Calculator and compare against the in-acquisition hash from Disk Imager's three-pass SHA256 verification. Matching hashes confirm the image transferred to evidence storage without alteration. For chain-of-custody hashing on PST and mailbox artifacts specifically, Sherlock Forensics PST Viewer embeds Ed25519-signed manifests in its verifiable export container which removes the manual per-artifact SHA256-compare step from the CoC documentation workflow.

Download Integrity

Software publishers provide SHA256 hashes for their downloads. After downloading, compute the hash of the file and compare it to the published value. A match confirms the file was not corrupted during transfer or modified by a third party. This is standard practice for security tools and operating system images.

Duplicate Detection

Files with identical content produce identical hashes regardless of filename. This property enables rapid duplicate detection across large evidence sets without comparing file contents byte by byte.

Forty-Eight Hash Algorithms

One build covers forty-eight algorithms, from MD2 through SHA-3, BLAKE3, KangarooTwelve, Streebog, GOST, Groestl, Skein, Ascon and BELT. The four an examiner reaches for most sit alongside the modern and regional algorithms a specific case can demand.

Proves Its Own Correctness

The tool checks itself against published test vectors for 37 of its 48 algorithms and reports the result. For the 11 that have no published vector it names them plainly rather than counting them, because a passing score tells an examiner working a Streebog case nothing about Streebog.

A Verdict You Can Stand Behind

If the tool could not fully read a tree it returns no verdict at all rather than a false all-clear. Every report states exactly what it did not cover. Exit codes stay strict: 0 for OK, 1 for mismatch, 2 for error.

One Read, Every Digest

Hash a whole evidence tree every way a case needs from a single pass, written as a manifest that names the algorithm on each line and verifies back the same way.

Resumable Acquisitions

A checkpoint writer records progress every few seconds so an interrupted run resumes and skips what has not changed, which matters on the multi-terabyte trees forensic work involves.

Device Provenance In Every Report

Every report records the volume serial, the volume label and the physical device model and serial underneath it, read without administrator rights so the tool never quietly asks for elevation on an examiner's machine.

SHA256

The forensic standard. 256-bit hash with no known practical collisions. Accepted by courts, NIST and law enforcement worldwide.

SHA512

512-bit hash for maximum collision resistance. Used in high-security environments and classified evidence handling.

MD5

Legacy 128-bit hash. Known collision vulnerabilities make it unsuitable as sole verification but still used for backward compatibility and quick duplicate detection.

SHA1

160-bit hash. Deprecated for security purposes after demonstrated collisions but still encountered in legacy systems and older forensic reports.

Drag-and-Drop Interface

Drag files or folders directly onto the application window. No file browser dialogs. Immediate hash computation on drop.

Batch Processing

Process entire directories in a single operation. Results display the SHA-256 (the forensic standard) per file in a sortable table.

CSV Export

Export hash results with filename, file path, file size and all computed hashes. Import directly into forensic reports and chain of custody documentation.