Work out how long hashing an evidence set takes from algorithm throughput, core count, storage read rate and per-file overhead.
Hashing is a streaming workload, so the time is the data volume divided by whichever ceiling is lower: the CPU's aggregate hash rate, or the rate the storage can deliver bytes. Millions of small files add a fixed cost per file — roughly 1.5 ms for the open, stat and close — which on a 250,000-file set is measured in minutes regardless of throughput. Verification is the step that makes evidence admissible, and it is routinely left out of acquisition schedules until it doubles the elapsed time of a job.
Hash Verification
hashTime = dataVolume ÷ min(perCoreThroughput × cores × scalingEfficiency, storageReadRate) + fileCount × 1.5 ms of per-file open, stat and close overhead.
hashTime = dataVolume ÷ min(perCoreThroughput × cores × scalingEfficiency, storageReadRate) + fileCount × 1.5 ms of per-file open, stat and close overhead. Hashing is a streaming workload, so the time is the data volume divided by whichever ceiling is lower: the CPU's aggregate hash rate, or the rate the storage can deliver bytes. Millions of small files add a fixed cost per file — roughly 1.5 ms for the open, stat and close — which on a 250,000-file set is measured in minutes regardless of throughput.
Verification is the step that makes evidence admissible, and it is routinely left out of acquisition schedules until it doubles the elapsed time of a job.
This calculator takes 7 inputs: Data to hash, Algorithm throughput per core, Cores used for hashing, Parallel scaling efficiency, Storage read rate, Number of files, Compute a second algorithm as well. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
For integrity against accidental corruption, yes, and many tools still record it. For anything an opponent might contest, use SHA-256: MD5 and SHA-1 have practical collision attacks, so a defence expert can argue that two different files could carry the same digest.
Because the read is shared. Both digests are computed over the same buffered stream, so you pay the I/O once and only the CPU work doubles — in practice about 1.8× the single-algorithm time.