Forensics
Not constant sha1sum Sep 08 2007 08:33AM
LERTI - Paul Vidonne (paul vidonne lerti fr)
Hello all !

Does smb met the following issue : several hash for an
unique file ? Of course a big one (4 GB). OS is Linux
Fedora. File system EXT3 mounted on a SATA RAID-5 on Adaptec
card

Could you enlighten me ?

Exemple :
[root@spica acquisit]# sha1sum -b 07667-SDH-dd.001
fe8195547af6d7ce76cd2e44160e06310a964063 *07667-SDH-dd.001

[root@spica acquisit]# sha1sum -b 07667-SDH-dd.001
e8dde55722ed1f2424fd7bb6246163120c561927 *07667-SDH-dd.001

[root@spica acquisit]# sha1sum -b 07667-SDH-dd.001
65f5eb98d33f7ccb1a8a82b0e6d916921c9d97b9 *07667-SDH-dd.001

The best is that the second hash is the good one !

Truly yours,

Paul Vidonne
--
LERTI - Laboratoire d'Expertise et de
Recherche de Traces Informatiques
http://www.lerti.fr +33.4 76 90 54 21

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus