Common Hashing Algorithms in Forensic Imaging
Which TWO of the following hashing algorithms are commonly used to verify the integrity of forensic images? (Choose two.)
Quick Answer
The answer is SHA-1 and MD5, the two hashing algorithms most commonly used to verify the integrity of forensic images. These algorithms produce fixed-size hash values—160-bit for SHA-1 and 128-bit for MD5—that serve as unique digital fingerprints; if the hash of the original image matches the hash of a copy, the data is considered unaltered. On the Computer Hacking Forensic Investigator CHFI exam, this concept tests your understanding of evidence integrity verification, often appearing in questions about tools like FTK Imager or EnCase. A common trap is assuming SHA-256 or newer algorithms are preferred in practice, but forensic workflows still rely on SHA-1 and MD5 due to their speed and widespread tool support, despite known collision weaknesses. Memory tip: think "5 and 5"—SHA-1 (160 bits) and MD5 (128 bits) are the forensic standard pair, like a digital handshake for evidence.
⚠ Common exam trap
EC-Council often tests the distinction between hashing algorithms (integrity) and encryption algorithms (confidentiality), so the trap here is that candidates confuse RSA and AES as hashing algorithms because they are cryptographic primitives, but they serve entirely different purposes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SHA-1
SHA-1 and MD5 are the two hashing algorithms most commonly used in forensic practice to verify the integrity of forensic images. They produce a fixed-size hash value (160-bit for SHA-1, 128-bit for MD5) that acts as a digital fingerprint; if the hash of the original image matches the hash of a copy, the data is considered unchanged. Despite known collision weaknesses, they remain the de facto standards in tools like FTK Imager, EnCase, and dd due to their speed and widespread tool support.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SHA-3
Why it's wrong here
SHA-3 is not yet standard in forensic tools.
- ✓
SHA-1
Why this is correct
SHA-1 is widely used in forensic imaging tools.
- ✗
RSA
Why it's wrong here
RSA is an encryption algorithm, not a hash.
- ✗
AES
Why it's wrong here
AES is a symmetric encryption algorithm.
- ✓
MD5
Why this is correct
MD5 is still commonly used despite collisions, but remains in many tools.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CHFI
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are common hashing algorithms used to verify the integrity of forensic images? (Select two.)
easy- A.AES
- ✓ B.SHA-1
- C.Blowfish
- D.RSA
- ✓ E.MD5
Why B: SHA-1 (Secure Hash Algorithm 1) and MD5 (Message Digest 5) are both cryptographic hash functions commonly used in digital forensics to verify the integrity of forensic images. They produce a fixed-size hash value (160 bits for SHA-1, 128 bits for MD5) from the image data, allowing examiners to confirm that the image has not been altered since acquisition. While MD5 is now considered weak against collision attacks, it remains widely used in forensic tools like FTK Imager and EnCase for quick integrity checks.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.