Announcement

Collapse
No announcement yet.

SHA-1 Hash Display

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • SHA-1 Hash Display

    The File SHA-1 Hash is displayed under the waveform statistics section under the Forensics Menu. Its is a cryptographic hash consisting of a 40 digit Hexadecimal number, which is essentially a fingerprint of the entire file. It is a good way to tell that one file is identical to another file. It can be useful in forensics to uniquely identify a file. That number is always calculated over the entire file regardless of the selected area.
    Last edited by Craig Maier; 05-03-2016, 11:47 AM.
    "Who put orange juice in my orange juice?" - - - William Claude Dukenfield

  • #2
    So...I take it that any change to the original file would then change the value of the "SHA 1 Hash" ? I'm not familiar with the term.


    Marc

    Comment


    • #3
      Marc,

      I am not sure how sensitive it is. Would have to experiment more with it to see if it can be fooled..

      Craig
      "Who put orange juice in my orange juice?" - - - William Claude Dukenfield

      Comment


      • #4
        It seems to be very sensitive and selective. I just muted just one sample in a file (did not eliminate the sample - just made it zero in value) and the SHA1 value completely changed.

        Craig
        Last edited by Craig Maier; 05-01-2016, 06:40 PM.
        "Who put orange juice in my orange juice?" - - - William Claude Dukenfield

        Comment


        • #5
          Here is an example that you can experiment with. I created the following file using the Make Waves Signal Generator found under the Edit Menu:

          1000 Hz
          -10 dB
          30 Seconds in Length
          Stereo
          44.1 kHz Sampling Rate
          Sine Wave
          16 Bit Resolution

          The Waveform Statistics (found under the Forensics Menu) yield the following data:

          Start Time = 00:00.0000
          Stop Time = 00:30.0000
          Selected Region = 00:30.0000sec
          Sample rate = 44100Hz
          Bit Depth = 16 Bits
          SHA1 Hash of file= FA43B1048458C9940CCDD0FCEA1771A81FA1CC60
          RMS = -13.0 dB
          Rectified Avg = -13.9 dB
          Max Pos Peak = -10.0 dB
          Max Neg Peak = -10.0 dB
          Crest Factor = 1.41
          Max LF Level (<10Hz) = -65.2 dB
          Avg LF Level (<10Hz) = -95.6 dB
          Clipped samples = 0

          Now, I went in and edited by muting one sample (not eliminating it, but just forcing it to become a value of 0). Here is the new Waveform Statistics for that change:

          Start Time = 00:00.0000
          Stop Time = 00:30.0000
          Selected Region = 00:30.0000sec
          Sample rate = 44100Hz
          Bit Depth = 16 Bits
          SHA1 Hash of file= 3CE09C5E7BDF0041209F2F4576CE6845B8DF28A8
          RMS = -13.0 dB
          Rectified Avg = -13.9 dB
          Max Pos Peak = -10.0 dB
          Max Neg Peak = -10.0 dB
          Crest Factor = 1.41
          Max LF Level (<10Hz) = -65.2 dB
          Avg LF Level (<10Hz) = -95.3 dB
          Clipped samples = 0


          So, it seems to be very sensitive & selective. Give it a try.

          Craig

          ps - Your original Make Waves file should yield the same original SHA1 Hash value that I measured. However, you have a very small probability of muting the exact same sample as did I, so your second SHA1 will not likely be the same as mine.
          Last edited by Craig Maier; 05-10-2016, 12:56 PM.
          "Who put orange juice in my orange juice?" - - - William Claude Dukenfield

          Comment

          Working...
          X