Cryptographic Hashing in Cyber Security: A Review of Hash Algorithms, Collision Attacks and Forensic File Integrity Verification

Cryptographic hash functions are a basic building block of cyber security, used to verify that files remain accurate, authentic and unaltered during storage, transmission and sharing. This paper reviews cryptographic hashing with emphasis on file integrity verification and digital forensics. It explains the properties of hash functions, namely fixed-length output, determinism, the avalanche effect, and preimage, second-preimage and collision resistance, and analyses the principal algorithms MD5, SHA-1, SHA-256, SHA-512 and SHA-3, including the Merkle–Damgård and sponge constructions. The history of practical attacks is traced, from collisions on MD5 to identical-prefix and chosen-prefix collisions on SHA-1, explaining why these algorithms must no longer be used for security. The verification process of hashing a file, storing the reference value securely, recomputing and comparing is described, together with applications in malware identification using known-file hash sets, preservation of digital evidence according to forensic guidelines, similarity hashing for detecting near-identical files, and secure software distribution. A five-layer file integrity verification architecture is proposed, along with research gaps, objectives, a comparison of algorithms and challenges such as protecting stored hashes, performance on large data and migration from legacy algorithms. The review concludes that SHA-256, SHA-512 and SHA-3, combined with protected reference values, provide reliable integrity assurance.