I was given a E01 image, along with a FTK generated checksum (MD5 & SHA1) to make sure nothing has been tampered with.
I installed filehash, and quickhash which gives me a hash that does not match the FTK-generated hash.
Why is that? It is a bit to bit copy of a memory card
If I add the E01 file to Autopsy the hash matches! Why?
Edited: In the E01.txt file there are FTK computed hashes Adding the E01 file to Autopsy -> Match between E01 validator and FTK computed hash
Quickhash does not match with the computed hash. Why is this?