We have released Seghash, an open source tool that does two things:
- calculates segmented hashes of image
- verifies calculated segmented hashes
Supported hash types: MD5, SHA1, SHA224, SHA256, SHA384, SHA512
Seghash is written in Go and released under MIT license. It works on Windows, Linux, and macOS. You can download the source and pre-built binaries from our Github account.
By releasing this open source tool we would like to encourage wide adoption of the segmented hashing algorithm by all software vendors who want to provide their users with a superior hashing option.
What is segmented hashing?
It is a hashing concept created by our company and implemented in Atola Insight Forensic.
With regular hashing, you get a single hash for the entire image.
With segmented hashing, you end up with many hashes of corresponding LBA ranges (chunks) of the image. The sum of these LBA ranges represents the entire image, just not necessarily in sequential order. By validating all hashes in a set, you can still prove that the entire image was not modified.
All segment hashes are saved in a CSV file with the following simple format:
Hash,start LBA,end LBA
75c92419e86ce82734ef3bbb781e6602,0,8388608 e2c7fc5264bae820e46c50b0502236d3,8388609,16777216 42718e48b5adb59563c98727cbce0619,16777217,25165824
… And so on until the last LBA.
- Forensic RAID rebuild in Atola TaskForce 2020.7 - July 30, 2020
- Q&A during the Interpol Digital Forensics Expert Group 2020 - June 19, 2020
- Insight Forensic 4.16 released with E01 segmented images - May 5, 2020