“Application of Message Digests for the Verification of Logical Forensic Data”

Mokhonoana and Olivier


Citation information

P. M. Mokhonoana and M. S. Olivier. “Application of Message Digests for the Verification of Logical Forensic Data”. In: Proceedings of the ISSA 2008 Innovative Minds Conference. Ed. by H. S. Venter et al. (Published electronically). Johannesburg, South Africa, July 2008


A message digest is a fixed length output produced by applying a cryptographic algorithm on input binary data of arbitrary length. If the input data changes even by one bit, the generated message digest will be completely different from the original. This is used in digital investigations to verify that stored digital evidence has not been tampered with.

This technique has been applied successfully on physical disk images because there is only one continuous stream of data. However, this is not applicable to logical disk images where there is no obvious or standard method of concatenating the data to produce an output message digest. This paper describes the diffculties that complicate the computation of a message digest for logical data. In addition, a candidate process for calculating a verification value for computer forensic evidence for logical data, regardless of its underlying representation is given. This method is presented in the context of cellphone forensics.

Full text

A pre- or postprint of the publication is available at http://mo.co.za/open/logicaldata.pdf.

BibTeX reference

AUTHOR={Pontjho M Mokhonoana and Martin S Olivier},
TITLE={Application of Message Digests for the Verification of Logical Forensic Data},
BOOKTITLE={Proceedings of the ISSA 2008 Innovative Minds Conference},
EDITOR={Hein S Venter and Mariki M Eloff and Jan H P Eloff and Les Labuschagne},
ADDRESS={Johannesburg, South Africa},
NOTE={(Published electronically)} )

[Publications] [Home]
Page maintained by Martin Olivier
Database updated: November 8, 2015

Beta version of new bibliography database; please report errors (or copyright violations) that may have slipped in.