Forensics
Re: Not constant sha1sum Sep 10 2007 05:29PM
jhill inicom net
If I'm reading your post correctly, you have an entirely Linux system (NOT mounting a remote SMB filesystem) that when you perform a SHA1Sum on a file you're getting different hashes? There are only a few things I can think of that would cause this:

1.) The file is changing but it's unlikely given your second hash matches a previously generated hash (I'm assuming from your comment).

2.) The SHA1Sum app isn't reading data in a consistent manner. This can be caused by a number of systems-level issues related to reading data:

*) The Adaptec RAID driver,

*) a bad implementation of the "read" call in the SHA1Sum app,

*) failing disk cache,

*) pick your random SysAdmin issue...

Linux doesn't complain as loudly as Windows does with these kinds of issues. I'd recommend copying the image off to another storage volume and trying to run the hash again. That would at least tell you if it's storage subsystem related. As a note, I'd recommend using dcfldd to copy it...

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus