After digital media are acquired, an exact duplicate image
(the forensic image) of the original media evidence is
created and validated with hash values that have been
calculated for the original digital media and the duplicate
image. A hashing function, e.g., MD5, SHA-1 and SHA-
256, applies a mathematical algorithm to the digital data
and returns a fixed-size bit string hash value. Any change
to the data will change the hash value. Data with the same
hash value are identical. The hash value validates that the
evidence is still in the original state.