Last materially reviewed: September 6, 2026
Direct Answer
A hash value is a digital fingerprint calculated from a file or set of data. In digital evidence work, comparing hash values can help show whether a file remained unchanged between collection, copying, analysis and presentation. A matching hash is strong evidence of file integrity, but it does not by itself prove who created the file, whether the original content was true, or whether the file was lawfully obtained.
Key Takeaways
- Hash values help verify file integrity.
- Changing even a small part of a file normally changes its cryptographic hash.
- Hashes are useful when creating forensic or working copies.
- A hash does not prove authorship, truth or legality.
- The algorithm used and the collection process should be documented.
How Does a Hash Work?
A cryptographic hash function converts data into a fixed-length value. Investigators can calculate a hash when evidence is collected and calculate it again later. If the values match using the same algorithm, that supports the conclusion that the file has not changed.
Why Are Hash Values Useful in Evidence Preservation?
Digital files can be copied perfectly, which is useful but also creates questions about whether a copy is identical to the source. Hash comparison provides a technical method for checking integrity across copies and stages of analysis.
What Can a Hash Prove?
- that two files are identical at the binary level when their secure cryptographic hashes match;
- that a preserved file has not changed since a documented hash was calculated; and
- that a forensic working copy corresponds to the preserved source image.
What Can a Hash Not Prove?
- who created the file;
- whether the file’s content is true;
- whether the source device belonged to a particular person;
- whether the evidence was obtained legally; or
- whether the original file was already manipulated before it was hashed.
Is a Hash Required for Every Screenshot or Chat?
No. The Rules on Electronic Evidence do not require a cryptographic hash for every piece of electronic evidence. Hashing is a preservation and integrity technique that becomes more valuable where technical authenticity, forensic imaging or chain of custody is likely to be disputed.
How Should Hash Information Be Documented?
Record the algorithm used, the exact file or image hashed, the date and time, the person who performed the process and the resulting value. Preserve the record with the evidence log.
Frequently Asked Questions
Does changing a filename change the hash?
Usually not if only the filename changes and the file contents stay identical. Changing the contents normally changes the file hash.
Can two different files have the same hash?
Cryptographic collisions are theoretically possible. Modern forensic practice uses suitable contemporary hash algorithms and may use more than one where appropriate.
Is a screenshot hash useful?
Yes, it can show that the screenshot file itself did not change after hashing. It does not prove that the underlying screen content was genuine.
Related Cybercode Guides
- Electronic Evidence Preservation
- Authenticate Electronic Evidence
- Metadata as Evidence
- Electronic Evidence Philippines
Official Sources
Appropriate forensic methods depend on the evidence, system and dispute.
Disclaimer
Important:
Continue through the electronic-evidence workflow
Admissibility is only one part of the analysis. Use these guides to preserve the source, prove authenticity and prepare the record:
This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.