Forensics
Not constant sha1sum Sep 08 2007 08:33AM
LERTI - Paul Vidonne (paul vidonne lerti fr) (4 replies)
Re: Not constant sha1sum Sep 10 2007 11:34PM
Greg Freemyer (greg freemyer gmail com)
Re: Not constant sha1sum Sep 09 2007 03:43AM
Morgan Reed (morgan s reed gmail com)
Re: Not constant sha1sum Sep 09 2007 03:39AM
Valdis Kletnieks vt edu
Re: Not constant sha1sum Sep 08 2007 06:54PM
Isaac Perez Moncho (suscripcions tsolucio com)
If hash changes the file had changed.
Hash should be the same for the same file (if not changed) always, if
not is useless.
What are you doing with this file? You are writing it while hashing?
You can control the access to the file?
Maybe a hide program is accessing it.

En/na LERTI - Paul Vidonne ha escrit:
> Hello all !
>
> Does smb met the following issue : several hash for an
> unique file ? Of course a big one (4 GB). OS is Linux
> Fedora. File system EXT3 mounted on a SATA RAID-5 on Adaptec
> card
>
> Could you enlighten me ?
>
> Exemple :
> [root@spica acquisit]# sha1sum -b 07667-SDH-dd.001
> fe8195547af6d7ce76cd2e44160e06310a964063 *07667-SDH-dd.001
>
> [root@spica acquisit]# sha1sum -b 07667-SDH-dd.001
> e8dde55722ed1f2424fd7bb6246163120c561927 *07667-SDH-dd.001
>
> [root@spica acquisit]# sha1sum -b 07667-SDH-dd.001
> 65f5eb98d33f7ccb1a8a82b0e6d916921c9d97b9 *07667-SDH-dd.001
>
> The best is that the second hash is the good one !
>
> Truly yours,
>
> Paul Vidonne
> --
> LERTI - Laboratoire d'Expertise et de
> Recherche de Traces Informatiques
> http://www.lerti.fr +33.4 76 90 54 21
>
>
>
>

--
Isaac Perez Moncho
GSEC, SSP-GHD, SSP-MPA, Microsoft MCP.
JPL TSolucio S.L
www.tsolucio.com

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus