13. MD5 values

• MD5 values are more trustworthy than filenames or file sizes in the process of data analysis.

• MD5 hash is an example of a derived attribute useful as an individual characteristic of a file.

• MD5 computation

  • has been well scrutinized by mathematical research;

  • is uniformly accepted in the investigative community;

  • is used to establish precedent in the courts.