±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36595
New Yesterday: 0 Visitors: 146

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

FTK Cd imaging problem?

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

schlecht
Member
 

FTK Cd imaging problem?

Post Posted: Dec 23, 05 20:29

I've run into something and I've been researching for a while, but haven't come up with anything specifically useful yet. I'm imaging a CD-Rom. Using FTK Imager 2.3 I verify the drive initially to get the 'original media' hash value. Then, using FTK imager I right click on the evidence I've already brought in (D:\) and click "Create Disk Image". All the details are then entered in and the disk image is created successfully. When I add the 'image' evidence into FTK imager and verify the image, the hash value doesn't match the original hash value of the D: drive.

Am I missing something here? Is the media corrupt or am I? Thanks for any help.
_________________
schlecht 
 
  

psu89
Senior Member
 

Re: FTK Cd imaging problem?

Post Posted: Dec 24, 05 01:47

Just a guess, but itn't the difference in hash values because of the difference in file formats (CDFS vs NTFS or FAT)?  
 
  

nickfx
Senior Member
 

Re: FTK Cd imaging problem?

Post Posted: Dec 24, 05 17:52

I think you will find that the hash of the 'contents' of a CDROM will not be the same as the hash value of the resulting image file. Writing this from a mobile so can't expand easily.
Drop a line to support @ accessdata.com they are always very helpful.

Nick  
 
  

jimvann
Newbie
 

Re: FTK Cd imaging problem?

Post Posted: Feb 06, 06 02:47

Unless I am mistaken FTK reads the media type data also. If this is true then unless you used the exact same media type the 2 CDs would have a different hash. My test show that if I check the hashes with CDR Inspector they are the same. Maybe someone here can confirm if I am correct or not.  
 
  

schlecht
Member
 

Re: FTK Cd imaging problem?

Post Posted: Feb 06, 06 08:36

It ended up being corrupt media.
_________________
schlecht 
 

Page 1 of 1