Digital Forensics

Hashing in the Forensic Workflow

Every defensible investigation rests on one repeatable act: computing a cryptographic hash — a fixed-length digital fingerprint of a file's contents. Change a single byte and the hash changes completely, so a matching value is strong proof that nothing was touched. In a forensic workflow you hash at the moment of acquisition, then re-hash after each copy, export or transfer, and compare. As long as the values agree, you can show the evidence is bit-for-bit identical to what you collected. e-Dex makes this the default rhythm of handling a file, and our deeper primer on the role of hashing in digital forensics explains why this step underpins everything that follows.

Acquisition, Verification and Custody in One Free Tool

Many teams stitch three separate utilities together — one to hash, one to track who held the file, one to produce paperwork. e-Dex folds them into a single workflow. You acquire evidence and capture its baseline hash, verify that hash on every later check with a plain match result, and record an unbroken chain of custody of who handled each file and when. Because the three steps live in one place, the integrity values, the custody log and the final document stay consistent with one another, and you can re-run a verification at any point to confirm a file is still exactly what it was.

Algorithms Accepted in Forensic Practice

e-Dex computes SHA-256, SHA-512 and BLAKE3 — the modern, collision-resistant algorithms widely accepted in forensic practice — and lists them side by side for every file. SHA-256 and SHA-512 are long-standing standards trusted across courts and audits; BLAKE3 adds a fast, strong modern option for large evidence sets. For continuity with older case records, e-Dex also records MD5 and SHA-1, so a verifier can match against whichever value was originally documented. If you want to try the computation itself, our forensic hash calculator guide walks through it step by step.

Evidence Packs & Signed Certificates

When a batch of evidence has to move between people or systems, e-Dex bundles it into a BagIt evidence pack — the files travel together with a manifest of their hashes, so anyone who receives the pack can re-validate every item and confirm nothing changed in transit. Alongside it, e-Dex produces a signed integrity certificate: a one-page record of the per-file hashes and an overall verification result, optionally sealed with a PAdES digital signature and an RFC-3161 trusted timestamp. Together the pack and the certificate turn a folder of files into a self-describing, verifiable unit of evidence.

Free, Offline, No Vendor Lock-In

e-Dex sits below the heavyweight forensic suites and does the one job most people actually need every day — proving files are unaltered — without a licence fee, a cloud account or a hardware dongle. It runs fully offline on a single Windows machine, so sensitive evidence never leaves your control, and it writes open, machine-readable outputs (hashes, BagIt manifests, certificates in HTML, JSON and XML) that any other tool can read. There is no proprietary container to escape and nothing to renew: download it, work locally, and keep your results in formats you own.

Frequently Asked Questions

What makes a digital forensics hashing tool forensically sound?
A forensically sound workflow hashes evidence at the moment of acquisition, re-hashes it after any copy or transfer, and records every match so the file can be shown to be unchanged. e-Dex computes a hash on acquisition, verifies it on each later check, and keeps the result alongside the chain of custody, so integrity is provable end to end rather than assumed.

Which hash algorithms does e-Dex use for digital forensics?
e-Dex computes SHA-256, SHA-512 and BLAKE3 — the modern, collision-resistant algorithms accepted in forensic practice — and also records MD5 and SHA-1 for compatibility with older case records. Listing several algorithms per file lets a verifier match against whichever value was originally documented.

Does e-Dex work offline, and is it really free?
Yes. e-Dex is a free Windows application that runs fully offline. Hashing, acquisition verification, chain-of-custody logging, building BagIt evidence packs and generating certificates all happen on your own machine, so your evidence files never leave your computer. An internet connection is only needed if you choose to apply an RFC-3161 trusted timestamp.

What is a BagIt evidence pack and why does it matter?
BagIt is a widely used file-packaging format that stores your evidence files together with a manifest of their hashes. e-Dex builds a BagIt pack so an entire batch of evidence travels as one verifiable bundle: anyone who receives it can re-validate every file against the manifest and confirm nothing changed in transit, and a signed certificate can accompany the pack as a one-page integrity record.

Start Acquiring and Verifying Evidence

Bring acquisition, verification, chain of custody, evidence packs and signed certificates into one free, offline workflow. e-Dex from Innovativa SoftTech (Pune) runs on a single Windows machine and keeps your evidence entirely under your control. Download e-Dex free and prove your files are exactly what they should be — or try the hash tool first.