Glossary
Hash verification
Recomputing an image's MD5/SHA-1 and comparing it to the hash recorded at acquisition, to prove the evidence has not changed since it was captured.
When an image is acquired, the tool hashes the media data and stores the result.
E01 keeps it inside the file (an MD5 in the hash section, MD5 plus SHA-1 in the
digest section on EnCase 6 and later). Verification means hashing the media
again later and checking it still matches.
A match says the bytes are identical to acquisition time. A mismatch says something changed: corruption in transit or storage, a bad sector that now reads differently, or tampering. It does not tell you which, only that the chain is broken, so you flag it and stop treating the affected regions as reliable.
MD5 is still used here despite being cryptographically broken because the threat model is accidental change, not a forged collision, though many shops record both MD5 and SHA-1. The parser verifies an image against its stored hashes.