Re: Two hash

At 13:45 11/12/04 +0100, LERTI - Paul Vidonne wrote:
> How can a same physical disk can receive a different hash (MD5) 
> from EnCase and Linux md5sum ? (both through a drive lock) ?
> Does smb meet this question ? Thanks.

Many thanks to those who raised questions and try to help me.

Linux used is Fedora distribution, kernel 2.6.8 and MD5Sum
is from coreutils version 5.2.1. Of course, disk to be checked
was not mounted. Binary and text give the same hash (option -i)

EnCase version is 3.19 (yes, I know, an old one, but it's not
the source of the problem). DOS is 7.10.

DiveLock (on USB) is from Intelligent Computer Solutions.

I note he following drive geometry and MD5 :

Linux/(hdparm /dev/sda )/disk on IDE port or Drivelock on USB
      : CHS 10337/240/36 Sectors : 156 301 488 
      : MD5 say "number1"
EnCase/Windows 2000/disk on Drivelock on USB 
      : CHS : 9729/255/63 Sectors : 156 296 385
      : MD5 say "number2"
EnCase/DOS/disk on IDE port
      : CHS 16383/16/63 Sectors : 156 301 488
      : MD5 say "number 1"
EnCase/DOS/disk on Drivelock on USB
      : CHS 9729/255/63 Sectors : 156 301 488
      : MD5 say "number 1"

When selecting the number of sectors to acquire, EnCase on Windows
don't accept more than 156 296 385. I suppose differences of hash
come from the 5 103 missing sectors. But why are they missing ?

--
LERTI - Laboratoire d'Expertise et de 
  Recherche de Traces Informatiques
http://www.lerti.fr +33.4 76 90 65 97


-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com