0

I was given a E01 image, along with a FTK generated checksum (MD5 & SHA1) to make sure nothing has been tampered with.

I installed filehash, and quickhash which gives me a hash that does not match the FTK-generated hash.

  1. Why is that? It is a bit to bit copy of a memory card

  2. If I add the E01 file to Autopsy the hash matches! Why?

Edited: In the E01.txt file there are FTK computed hashes Adding the E01 file to Autopsy -> Match between E01 validator and FTK computed hash

Quickhash does not match with the computed hash. Why is this?

2
  • "I ran a command, and the output was not what I expected. Why?" That's not a lot to go on. Can you provide any other detail?
    – schroeder
    Nov 23, 2016 at 18:04
  • @schroeder Basically wondering why there are two seperate hashvalues? Quickhash and FTK/Autopsy have different MD5 hashes of the same file. It is very confusing
    – hvnwjxlg
    Nov 23, 2016 at 22:25

1 Answer 1

1

Because QuickHash hashes "the file", whereas FTK Imager hashes the internal content of an E01 set.

e.g. if you have 10 image segments (E01 - E010), each segment is a file on disk. It contains the acquired data from the original disk and various values pertinent to the E01 image like CRC checks and metadata. When Quickhash is passed one image segment, it reads the file and tells you the hash of it. When you open an E01 image in FTKi however, FTKi reads all 10 image segments together, ignores the metadata and CRC stuff and hashes the cummlative acquired data. That resulting hash value will match the original hash of the disk.

The QuickHash user manual also explains this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .