top of page

What changes a hash value?


It's common knowledge that making even a minor change to an electronic file (deleting a period or adding a single letter to a Word document) will generate an entirely different MD5 or SHA-1 hash value for the file. However it's less well known exactly what actions till cause the hash value of the file to change. Craig Ball explored this issue in his blog, Ball in Your Court.

It should be readily apparent that changing the system metadata of a file, will not alter the hash value. Hash values are calculated only on the basis of the contents of the file. Changes to the file metadata will produce new hash values. You can be certain that a file's hash value will not change if it is opened from read only media.

According to Ball here's what will and will not cause a new hash value to be generated:

HASH VALUE STAYS THE SAME

1. Changing the file extension

2. Emailing a file as an attachment and then receiving it back in another email.

3. Renaming a file without opening it.

HASH VALUE CHANGES

1. Copying the text of a Word document into a new Word document.

2. Printing out a Word document [the last printed date is a meta data field].

3. Opening a file and then renaming it.


Sean O'Shea has more than 20 years of experience in the litigation support field with major law firms in New York and San Francisco.   He is an ACEDS Certified eDiscovery Specialist and a Relativity Certified Administrator.

​

The views expressed in this blog are those of the owner and do not reflect the views or opinions of the owner’s employer.

​

If you have a question or comment about this blog, please make a submission using the form to the right. 

Your details were sent successfully!

© 2015 by Sean O'Shea . Proudly created with Wix.com

bottom of page