On Mon, 13 Dec 2004 16:02:17 +0100, LERTI - Paul Vidonne
<paul.vidonne@lerti.fr> wrote:
At 13:45 11/12/04 +0100, LERTI - Paul Vidonne wrote:
How can a same physical disk can receive a different hash (MD5)
from EnCase and Linux md5sum ? (both through a drive lock) ?
Does smb meet this question ? Thanks.
Many thanks to those who raised questions and try to help me.
Linux used is Fedora distribution, kernel 2.6.8 and MD5Sum
is from coreutils version 5.2.1. Of course, disk to be checked
was not mounted. Binary and text give the same hash (option -i)
EnCase version is 3.19 (yes, I know, an old one, but it's not
the source of the problem). DOS is 7.10.
DiveLock (on USB) is from Intelligent Computer Solutions.
I note he following drive geometry and MD5 :
Linux/(hdparm /dev/sda )/disk on IDE port or Drivelock on USB
: CHS 10337/240/36 Sectors : 156 301 488
: MD5 say "number1"
EnCase/Windows 2000/disk on Drivelock on USB
: CHS : 9729/255/63 Sectors : 156 296 385
: MD5 say "number2"
EnCase/DOS/disk on IDE port
: CHS 16383/16/63 Sectors : 156 301 488
: MD5 say "number 1"
EnCase/DOS/disk on Drivelock on USB
: CHS 9729/255/63 Sectors : 156 301 488
: MD5 say "number 1"
When selecting the number of sectors to acquire, EnCase on Windows
don't accept more than 156 296 385. I suppose differences of hash
come from the 5 103 missing sectors. But why are they missing ?
--
LERTI - Laboratoire d'Expertise et de
Recherche de Traces Informatiques
http://www.lerti.fr +33.4 76 90 65 97
I still think you have an HPA on the drive. (Host Protected Area)
Linux 2.6 by default will see the HPA and ignore the artificial
restriction. i.e. It will note the presence of the HPA in messages,
but uses the true physical size not the HPA size.
OTOH, Win2K accepts the HPA request at face value and does not allow
access to the protected area.
FYI: This feature of Win2K is why we try to avoid imaging via windows.
It effects Encase 3 and FTK Imagers. I assume it effects all
Windoews based imaging software.
So, when you boot under Linux, look in /var/log/messages (or dmesg).
See if this drive has an HPA (Host Protected Area).
Greg
--
Greg Freemyer
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
