Forensics
Not constant sha1sum Sep 08 2007 08:33AM
LERTI - Paul Vidonne (paul vidonne lerti fr) (4 replies)
Re: Not constant sha1sum Sep 10 2007 11:34PM
Greg Freemyer (greg freemyer gmail com)
On 9/8/07, LERTI - Paul Vidonne <paul.vidonne (at) lerti (dot) fr [email concealed]> wrote:
> Hello all !
>
> Does smb met the following issue : several hash for an
> unique file ? Of course a big one (4 GB). OS is Linux
> Fedora. File system EXT3 mounted on a SATA RAID-5 on Adaptec
> card
>
> Could you enlighten me ?
>
> Exemple :
> [root@spica acquisit]# sha1sum -b 07667-SDH-dd.001
> fe8195547af6d7ce76cd2e44160e06310a964063 *07667-SDH-dd.001
>
> [root@spica acquisit]# sha1sum -b 07667-SDH-dd.001
> e8dde55722ed1f2424fd7bb6246163120c561927 *07667-SDH-dd.001
>
> [root@spica acquisit]# sha1sum -b 07667-SDH-dd.001
> 65f5eb98d33f7ccb1a8a82b0e6d916921c9d97b9 *07667-SDH-dd.001
>

The only times I've seen inconsistent hashes, there were disk errors
reported in /var/log/warn.

ie. Some sectors were failing the CRC check repeatedly and returning
different values each time they were read.

Greg
--
Greg Freemyer
Litigation Triage Solutions Specialist
http://www.linkedin.com/in/gregfreemyer

The Norcross Group
The Intersection of Evidence & Technology
http://www.norcrossgroup.com

[ reply ]
Re: Not constant sha1sum Sep 09 2007 03:43AM
Morgan Reed (morgan s reed gmail com)
Re: Not constant sha1sum Sep 09 2007 03:39AM
Valdis Kletnieks vt edu
Re: Not constant sha1sum Sep 08 2007 06:54PM
Isaac Perez Moncho (suscripcions tsolucio com)


 

Privacy Statement
Copyright 2010, SecurityFocus