Hashes, FTK vs Quickhash

Question

I was given a E01 image, along with a FTK generated checksum (MD5 & SHA1) to make sure nothing has been tampered with.

I installed filehash, and quickhash which gives me a hash that does not match the FTK-generated hash.

1. Why is that? It is a bit to bit copy of a memory card

2. If I add the E01 file to Autopsy the hash matches! Why?

Edited: In the E01.txt file there are FTK computed hashes Adding the E01 file to Autopsy -> Match between E01 validator and FTK computed hash

Quickhash does not match with the computed hash. Why is this?

Answer 1

Because QuickHash hashes "the file", whereas FTK Imager hashes the internal content of an E01 set.

e.g. if you have 10 image segments (E01 - E010), each segment is a file on disk. It contains the acquired data from the original disk and various values pertinent to the E01 image like CRC checks and metadata. When Quickhash is passed one image segment, it reads the file and tells you the hash of it. When you open an E01 image in FTKi however, FTKi reads all 10 image segments together, ignores the metadata and CRC stuff and hashes the cummlative acquired data. That resulting hash value will match the original hash of the disk.

The QuickHash user manual also explains this.