±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36632
New Yesterday: 3 Visitors: 131

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Extracted File Hash Different from Report Hash

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

silentwitness33
Newbie
 

Extracted File Hash Different from Report Hash

Post Posted: Nov 27, 19 00:25

Folks,

I'm using Axiom to parse through a media card image and found numerous digital pictures of interest. Axiom carved these pictures from unallocated space. For each picture, Axiom generated an MD5 and SHA1 hash value. I've exported each of the relevant pictures from the image to be used in a later report. However, after exporting the pictures I hashed them all using a separate program and expected the hash values to match the values generated by Axiom but this isn't the case. The artifacts that I extracted all have different hash values. Can someone help me understand what I am missing here?

Thanks  
 
  

silentwitness33
Newbie
 

Re: Extracted File Hash Different from Report Hash

Post Posted: Nov 27, 19 15:54

I've done some further testing using an image which contains both parsed and carved pictures. I am finding that hash values for pictures that have been parsed and extracted out as artifacts match those in Axiom's reporting. However, it is only the carved files that have mismatching hash values after being extracted. Thoughts?  
 
  

BDME
Member
 

Re: Extracted File Hash Different from Report Hash

Post Posted: Nov 27, 19 18:13

Is Axiom adding data to the end of the file while exporting them out to make them a specific size? The same idea as exporting the logical contents of the file versus exporting the physical contents of the file?  
 
  

mscotgrove
Senior Member
 

Re: Extracted File Hash Different from Report Hash

Post Posted: Nov 27, 19 20:57

If you have both photos as separate files then you can check the file size. A single byte different in length will be a different hash value. Carving does not always get the correct file size. If the files are the same size, then do a binary file compare and see what the difference is
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk 
 

Page 1 of 1