Cyber-Med — Health Data Protection
← Back to insights

DIGITAL FORENSICS · CYBER-MED

A hash value: what it checks and what it does not prove.

Redazione Cyber-Med · Aggiornato il

Comparing data integrity is one part of an analysis. Origin, authorship and the meaning of the content require context and further checks.

A value calculated from data

The NIST glossary defines a hash value as the result of applying a hash function to data. In forensic work, hash values can be calculated from acquired data and working copies to perform integrity comparisons. NIST SP 800-86 describes this use in data collection and verification.

A comparison needs to be described: which data was read, which algorithm was used and which operations were recorded. A hash concerns the data it was actually calculated from; it does not automatically represent everything on a device.

A simple example, without a real case

Imagine a fictional document and its copy. After a file is changed, a comparison may detect a different hash value. With the same algorithm, different hash values indicate different data: the result helps identify a difference, but does not by itself explain who caused it or why.

Matching hash values support an integrity comparison when the algorithm and procedure are appropriate. They do not certify that the document’s statements are true, nor rule out changes made before the first acquisition.

From comparison to reporting

The distinction is practical: a hash addresses a technical question about the compared data. Establishing origin, authorship or an event sequence requires other evidence and contextual analysis. A report should make the distinction between observations and interpretations clear.

Start with the question

For an initial discussion with Cyber-Med, describe the question and available sources. Acquisition and transfer arrangements are agreed for the assignment; evidence and confidential documents are not needed in the first message.

Sources and further reading

NIST CSRC — Hash value/result

NIST SP 800-86 — Data collection and integrity, sections 3.1.2 and 4.2.2

Sources checked on 14/10/2026. SP 800-86 is a 2006 guide, used here for the methodological principle of comparison and documentation, not for selecting current algorithms or defining Italian procedural rules. The example is fictional; the explanation of context and limitations is Cyber-Med educational content.

Scopri il servizio Cyber-Med ↗

Let’s discuss your project ↗

The topic in 35 seconds

Silent educational video with Italian on-screen text. Italian and English subtitles and transcript are available.

Read the transcript
  1. 00:00–00:07 A hash value. Not the whole story. A hash helps compare data. It does not identify the author or prove the content is true on its own.
  2. 00:07–00:14 Which data are we comparing? Record the file, algorithm and comparison steps. The hash depends on the data read.
  3. 00:14–00:21 Has the copy changed? Fictional example: an edited file. Different hash values with the same algorithm indicate different data.
  4. 00:21–00:28 Who? When? In what context? These questions require other evidence and checks. A hash alone does not provide the answer.
  5. 00:28–00:35 Data, methods and explicit limitations. A report explains the comparison and what remains to be established. info@cyber-med.it

Open the video ↗

View the carousel: 5 cards
A hash value. Not the whole story. A hash helps compare data. It does not identify the author or prove the content is true on its own.
Which data are we comparing? Record the file, algorithm and comparison steps. The hash depends on the data read.
Has the copy changed? Fictional example: an edited file. Different hash values with the same algorithm indicate different data.
Who? When? In what context? These questions require other evidence and checks. A hash alone does not provide the answer.
Data, methods and explicit limitations. A report explains the comparison and what remains to be established. info@cyber-med.it
Chat with us