FTK Cd imaging prob...
 
Notifications
Clear all

FTK Cd imaging problem?

5 Posts
4 Users
0 Likes
969 Views
schlecht
(@schlecht)
Posts: 46
Eminent Member
Topic starter
 

I've run into something and I've been researching for a while, but haven't come up with anything specifically useful yet. I'm imaging a CD-Rom. Using FTK Imager 2.3 I verify the drive initially to get the 'original media' hash value. Then, using FTK imager I right click on the evidence I've already brought in (D\) and click "Create Disk Image". All the details are then entered in and the disk image is created successfully. When I add the 'image' evidence into FTK imager and verify the image, the hash value doesn't match the original hash value of the D drive.

Am I missing something here? Is the media corrupt or am I? Thanks for any help.

 
Posted : 23/12/2005 8:29 pm
psu89
(@psu89)
Posts: 118
Estimable Member
 

Just a guess, but itn't the difference in hash values because of the difference in file formats (CDFS vs NTFS or FAT)?

 
Posted : 24/12/2005 1:47 am
nickfx
(@nickfx)
Posts: 131
Estimable Member
 

I think you will find that the hash of the 'contents' of a CDROM will not be the same as the hash value of the resulting image file. Writing this from a mobile so can't expand easily.
Drop a line to support@accessdata.com they are always very helpful.

Nick

 
Posted : 24/12/2005 5:52 pm
(@jimvann)
Posts: 1
New Member
 

Unless I am mistaken FTK reads the media type data also. If this is true then unless you used the exact same media type the 2 CDs would have a different hash. My test show that if I check the hashes with CDR Inspector they are the same. Maybe someone here can confirm if I am correct or not.

 
Posted : 06/02/2006 2:47 am
schlecht
(@schlecht)
Posts: 46
Eminent Member
Topic starter
 

It ended up being corrupt media.

 
Posted : 06/02/2006 8:36 am
Share: