Hash Verification Calculator
Work out how long hashing an evidence set takes from algorithm throughput, core count, storage read rate and per-file overhead.
Inputs
Many labs record MD5 and SHA-256 side by side
Total Hashing Time
21.8minutes
Effective Hash Throughput
0.54GB/s
CPU Hashing Ceiling
5.40GB/s
Storage Read Ceiling
0.54GB/s
Per-File Overhead
6.3minutes
Limiting Factor
Storage read rate — the disks cannot feed the CPUs
Step by step
Values used
Data to hash = 500 GB; Algorithm throughput per core = SHA-256 with SHA-NI — 1.8 GB/s; Cores used for hashing = 4 cores; Parallel scaling efficiency = 75 %; Storage read rate = 550 MB/s; Number of files = 250,000 files; Compute a second algorithm as well = No
Hash Verification
hashTime = dataVolume ÷ min(perCoreThroughput × cores × scalingEfficiency, storageReadRate) + fileCount × 1.5 ms of per-file open, stat and close overhead.
Total Hashing Time
= 21.8 minutes
Effective Hash Throughput
= 0.54 GB/s
CPU Hashing Ceiling
= 5.40 GB/s
Storage Read Ceiling
= 0.54 GB/s
Per-File Overhead
= 6.3 minutes
Limiting Factor
= Storage read rate — the disks cannot feed the CPUs
How it works
Hashing is a streaming workload, so the time is the data volume divided by whichever ceiling is lower: the CPU's aggregate hash rate, or the rate the storage can deliver bytes. Millions of small files add a fixed cost per file — roughly 1.5 ms for the open, stat and close — which on a 250,000-file set is measured in minutes regardless of throughput. Verification is the step that makes evidence admissible, and it is routinely left out of acquisition schedules until it doubles the elapsed time of a job.
Formula
Hash Verification
hashTime = dataVolume ÷ min(perCoreThroughput × cores × scalingEfficiency, storageReadRate) + fileCount × 1.5 ms of per-file open, stat and close overhead.
- perCoreThroughput
- GB/s for one core of the chosen algorithm
- scalingEfficiency
- Fraction of linear speed-up achieved across cores
- storageReadRate
- Sequential read rate of the evidence store
Frequently Asked Questions
How is Hash Verification calculated?
hashTime = dataVolume ÷ min(perCoreThroughput × cores × scalingEfficiency, storageReadRate) + fileCount × 1.5 ms of per-file open, stat and close overhead. Hashing is a streaming workload, so the time is the data volume divided by whichever ceiling is lower: the CPU's aggregate hash rate, or the rate the storage can deliver bytes. Millions of small files add a fixed cost per file — roughly 1.5 ms for the open, stat and close — which on a 250,000-file set is measured in minutes regardless of throughput.
Why does Hash Verification matter?
Verification is the step that makes evidence admissible, and it is routinely left out of acquisition schedules until it doubles the elapsed time of a job.
What values do I need to enter?
This calculator takes 7 inputs: Data to hash, Algorithm throughput per core, Cores used for hashing, Parallel scaling efficiency, Storage read rate, Number of files, Compute a second algorithm as well. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Is MD5 still acceptable for evidence integrity?
For integrity against accidental corruption, yes, and many tools still record it. For anything an opponent might contest, use SHA-256: MD5 and SHA-1 have practical collision attacks, so a defence expert can argue that two different files could carry the same digest.
Why is dual hashing less than twice the cost?
Because the read is shared. Both digests are computed over the same buffered stream, so you pay the I/O once and only the CPU work doubles — in practice about 1.8× the single-algorithm time.
You might also need
- Evidence Transfer Time CalculatorCommonly used together
- Disk Imaging Time CalculatorCommonly used together
- Timeline Analysis CalculatorCommonly used together
- Memory Dump Size CalculatorCommonly used together
- Enterprise Cybersecurity Health Score CalculatorAlso in Forensics & Emerging Threats
- Kill Chain Coverage CalculatorAlso in Forensics & Emerging Threats