Recovering images based on MD5 hash values

As part of an investigation it is useful to be able to select images based on known MD5 values. CnW software has this option for both working disks, and when an image is recovered from a raw scan.

Part of the file filter is the option to select a table of hash values. For police investigations this table may be filled with known ‘dubious’ hash values. The structure of the hash table is a sorted ASCII text file of all hash values required to be tested. The filter can then be set to skip all files except those that match the hashes. As the hash is not file name dependent, any renaming of files will be ignored.

CnW Recovery software has another very powerful feature that relates to hashing and raw imaging. Many recovery programs will correctly find JPEG files but not set the correct length. CnW, when it finds a JPEG file, it will calculate the correct file size, and then recalculate the hash value. There is also a mode where JPEGs will be found on disks that had NTFS compression enabled.

The log, when the forensic option has been purchased, will display all files matching, along with their MD5 value.