Is MD5 still defensible for forensic verification?
- THE CONFUSION
- Collision resistance vs error detection
- HOUSE PRACTICE
- Record MD5 and SHA-256
- READ TIME
- 9 min
Yes, for verifying an image against its own source — and the objection that says otherwise confuses two different properties. MD5 is not collision resistant, which defeats it as a signature. Verification does not use collision resistance; it uses the fact that changing any bit of the input changes the output, and no adversary controls both sides of that comparison.
Is MD5 still defensible in 2026?
For its ordinary forensic use — showing that a copy of a device matches the device it was taken from — yes. For any use where someone could choose the content of both files being compared, no, and that has been true for years.
The argument against MD5 is a real cryptographic result being applied to the wrong problem. It appears in opposing reports, in cross-examination, and periodically in briefs, usually in the form: MD5 has been broken since the mid-2000s, the examiner verified this image with MD5, therefore the verification is worthless. Every clause of that is either true or plausible except the inference joining them.
This page takes the two properties apart, says which one a verification actually depends on, identifies the workflows where the objection is correct, and sets out what a report should contain so the question is answered on the record rather than in the witness box.
Collision resistance and error detection are not the same property
A hash function can be asked to do several unrelated jobs, and it can be good at some and bad at others. Two of those jobs matter here.
| PROPERTY | WHAT IT MEANS | DOES MD5 HAVE IT? | DOES FORENSIC IMAGE VERIFICATION USE IT? |
|---|---|---|---|
| Error detection | Any change to the input — a single flipped bit — produces a different output, so a match between two computations means the inputs did not differ. | Yes. This property is undisturbed by the collision work and is what a checksum is for. | Yes. This is the entire mechanism. |
| Collision resistance | Nobody can construct two different inputs that produce the same output, even with full control over both. | No. An attacker who controls both inputs can construct an MD5 collision. | No. The examiner did not author the device, and the comparison is between one artifact and a copy of itself. |
| Pre-image resistance | Given an output, nobody can construct an input that produces it. | No practical attack is known, but MD5 is not relied on for this in any current standard. | No. Verification never works backwards from a value. |
| SHA-256, for contrast | The same error-detection property, plus collision resistance with no known practical attack. | Yes to all three. | Yes — and it is the value that should carry any argument. |
The reason the distinction is load-bearing rather than pedantic is that a collision attack requires an adversary who chooses both files. That adversary exists in the scenario the research was aimed at: someone producing a benign document and a malicious one with the same hash, so that a signature on the first also validates the second. There is no equivalent actor in an acquisition, because one side of the comparison is a device whose contents the examiner is reading and the other is the copy being written from it in the same session.
A collision attack requires an adversary who chooses both files. There is no equivalent actor in an acquisition.
What does image verification actually compare?
Mechanically: a value computed over the source device as it is read, and a value computed over the resulting forensic image afterwards. Those two values matching is what allows an examiner to say the copy is the evidence. The comparison is between a thing and a reproduction of that same thing, taken minutes apart, by one process, under write-block.
Modern container formats add a second layer that the MD5 objection usually ignores entirely. An E01 or Ex01 image carries per-block checksums inside the container as well as an overall acquisition hash, so corruption within the image can be localised rather than merely detected. A raw sector-for-sector copy has no such structure, which is one reason the container formats are preferred where the tooling permits.
What the match does not establish
This is the more consequential limit, and the one worth spending the deposition question on. A hash match establishes identical content. It says nothing about:
- where a file came from — the transfer path is not recorded anywhere in a hash value;
- when it arrived on the device, which is a question for filesystem and journal records;
- who put it there, which requires attribution evidence from outside the machine;
- whether it came from the party alleging the copying at all, as opposed to a common source both parties had.
And a non-match excludes nothing. Any edit — a metadata change, a re-save in a different application version — produces a different value for content a person would call the same document. An opinion that treats a hash mismatch as proof that two documents are unrelated has made the mirror image of the error this page is about.
Evidence About a Process or System. Evidence describing a process or system and showing that it produces an accurate result.
That subdivision is where an examiner’s foundation testimony about acquisition and verification usually lands, and it is worth noticing what it asks for: a description of the process, and a showing that the process produces an accurate result. Not a proof that the algorithm is unbreakable. A recorded comparison the examiner actually performed is responsive to the rule as written.
Where does MD5 genuinely fail?
In every workflow where the comparison is against a corpus somebody else may have influenced. These are real, they are not hypothetical, and an examiner who defends MD5 without conceding them is overstating in the other direction.
- Known-file and hash-set matching. Identifying a file by matching its hash against a library of known files is a comparison against content the examiner did not author. The library was built from files someone else produced. Use a stronger algorithm where the identification itself is the finding.
- De-duplication and exclusion across a production. Where identical content is being suppressed or promoted on the strength of a hash, the parties are supplying the inputs. ESI protocols that specify a hash field should specify the algorithm, and it should be the strong one.
- Anything functioning as a signature. A certificate, a code-signing operation, a tamper-evident seal on an export. This is the use MD5 is actually broken for, and there is no argument for it.
- Attribution of a file to a specific source by hash alone. Weak for a different reason. Even with a collision-resistant algorithm, identical content does not establish a route. The algorithm is not the limitation here; the inference is.
What does defensible practice look like now?
- Compute both values in one pass. MD5 and SHA-256 together. Most acquisition tools do this by default and the time cost is irrelevant at the scale of a single device. The stronger value carries the argument; the older one keeps the acquisition comparable with legacy tooling, older productions, and hash sets built before the transition.
- Record them at acquisition and again at verification. Two points, four values, all of them in the acquisition log rather than summarised in a sentence. A report that asserts the hashes matched, without producing them, has left an opposing examiner nothing to check and has therefore given up the testability point.
- Record a mismatch when one happens, and explain it. Live acquisitions from running systems produce mismatches legitimately, because the source changes while it is being read. Documented and explained, that is an ordinary acquisition note. Undocumented, it is the single most damaging thing that can surface in a deposition.
- Hash the working copy too, and say when it was checked. Analysis runs on a working copy, never the original. Verifying the working copy against the acquisition value closes the gap between “the image is good” and “the thing I examined is the image”.
- Name the algorithm in the ESI protocol. One clause, agreed before collection. Two parties hashing with different algorithms cannot de-duplicate against each other, and the discovery arrives after production.
Everything in that list is also the answer to the cross-examination, which is the point of doing it in the order given. The work that makes the hash question unanswerable in a deposition is done at acquisition, not in preparation.
The cross-examination, and the answer
Hash attacks appear in the reported rulings, and the pattern is consistent: they are traded away rather than won.
In United States v. Collins the defence’s own forensic computer expert agreed with the government agent that SHA-1 values are in excess of 99.9999 percent accurate, and the challenge was abandoned. In United States v. Owens both sides’ experts agreed that where hash values match, the chance the files differ is astronomically small — and the Seventh Circuit relied on a hash match for every one of the 226 pieces of the file as one of four convergent artifacts supporting the opinion. In State v. Roberts the Utah Supreme Court affirmed admission of testimony about a hash-matching toolkit where the expert explained the method and officers independently reviewed the files it identified.
The most instructive of the four is Krause v. State, where the FBI examiner conceded he did not know how the hash algorithm worked and his testimony about hash-verified duplicates was admitted anyway. He could explain what a matching hash establishes and that he had verified one. That is the whole lesson: recording both hashes converts an unanswerable question about cryptography into an answerable question about a comparison the examiner actually made.
| THE QUESTION | THE ANSWER | THE ANSWER TO AVOID |
|---|---|---|
| MD5 has been broken for twenty years, has it not? | For constructing collisions where an attacker controls both files, yes. That is not what a verification compares, and SHA-256 was recorded as well. | A denial. The collision result is real and disputing it costs the witness the rest of the examination. |
| So you cannot rule out that this image is not the original? | The source and the image were hashed in the same session under write-block, both algorithms matched, and the acquisition log records the values. | “It is impossible” — the claim the 2023 advisory committee note singles out as the kind of absolute assertion the amendment targets. |
| Can you explain how the algorithm computes the value? | In general terms, and what matters here is what a match establishes and that the comparison was performed and recorded. | An improvised explanation of the compression function. |
| The hashes did not match on this device, did they? | No. It was a live acquisition from a running system, the mismatch is recorded in the log with the reason, and here is what was done to bound it. | Anything that looks like the first time the witness has considered it. |
One closing asymmetry. The examiner who recorded both values has a two-sentence answer and moves on. The examiner who recorded one has a genuine argument available and will spend twenty minutes making it in front of a judge who did not come to hear about compression functions. The cost of the second value is a checkbox.
Frequently asked questions
Is MD5 broken?
For adversarial use, yes. MD5 is not collision resistant: someone who controls both inputs can construct two different files with the same MD5 value. That defeats MD5 as a signature or a certificate algorithm. It does not defeat MD5 as a check on whether a copy differs from its source, which is a scenario with no adversary choosing both sides of the comparison.
Can an MD5 collision be used to fake a forensic image?
Constructing a collision requires control over the content of both files. A drive image is a bit-for-bit copy of a device the examiner did not author, hashed while it is being read, and compared against a value computed over the source at the same session. Nobody is crafting a collision against a device image mid-acquisition. The practical answer on the record is that both MD5 and SHA-256 were computed and both matched.
Should forensic images still be hashed with MD5 at all?
Recording both MD5 and SHA-256 is standard practice, and there is a reason for each. SHA-256 carries the argument, because it has no known practical collision attack. MD5 keeps the acquisition comparable with legacy tooling, older productions and hash sets that were built with it. Computing both costs one pass, and most acquisition tools do it by default.
Does a hash match prove a file was copied from the plaintiff?
No, and this is a larger error than anything about MD5. A hash match shows two files have identical content. It carries no information about the transfer path, the arrival date, who put the file there, or whether it came from the party alleging the copying. A non-match does not exclude copying either, since any edit changes the value.
What does a hash mismatch at verification mean?
Usually that the source changed while it was being read, most often a live acquisition from a running system. That is a legitimate and explainable event. What damages an opinion is a mismatch the examiner never recorded, never noticed, or cannot account for, because it leaves the court no way to distinguish read error from alteration.
Which hash algorithm should an ESI protocol specify?
It should specify one explicitly, and SHA-256 is the ordinary choice. The reason is operational rather than cryptographic: two productions hashed with different algorithms cannot be de-duplicated against each other, so discovering the mismatch after production costs a re-production. Agreeing the algorithm in the protocol costs one clause.
Law & Forensics records both hash values at acquisition and at verification, logs mismatches with their cause, and states in the report what a match does and does not establish. If evidence integrity is contested in your matter — start a conflicts check or reach us directly below.
ENGAGE AN EXPERT→Or write to info@lawandforensics.com or call 855-529-2466.
Related reading
- Chain of custody for digital evidence
Where the hash values sit in the custody record, and which gaps a court has treated as weight rather than admissibility.
- What is a forensic tool's error rate?
The hash question is the one place a numeric answer exists, and the guide sets out what courts have accepted everywhere else.
- Hash collision, defined
The glossary entry, with the same distinction stated in three sentences for a reader who needs it in a brief.
- Computer forensics
Acquisition under write-block, verification, and the artifacts the examination reads once the image is proved.
- The Daubert Docket
The rulings where hash reliability was raised, and what happened to each challenge.
Attorney advertising / expert services. General information about evidence law and forensic practice, not legal advice, and not a substitute for checking the rules and case law of your own forum.