Create an account Home  ·  Topics  ·  Downloads  ·  Your Account  ·  Submit News  ·  Top 10  
Modules
· Home
· Content
· FAQ
· Forensic Downloads
· Forensics Feedback
· Forums
· Members List
· Statistics
· Surveys
· Top 10
· Topics
· Training Reviews
· Web Links
· Your Account

Our Membership

Latest: TheresaDelcas
New Today: 0
New Yesterday: 0
Overall: 29232

Computer Forensics
This is a free and open peer to peer medium for digital and computer forensics professionals and students. Please help us maintain it by contributing and perhaps linking to us from your own website.

Recent Posts

 Jollyhers : Boutique Dresses For Little Girls2017
 welcome to buy safewow 6% or 8% off wow cheap gold from July
 Viewing real MAC times of a timestomped file
 software that can view files in Volume Slack
 Case Study exam questions

Computer Forensics World Forums


Pages Served
We received
48641133
page views since August 2004

Security Sources

FTC
OnGuard Online
ISO 17799 ISO 27001
ISO 27000 Toolkit
ISO 27001 & 27000
Cryptography
Security Policies

Computer Forensics World: Forums

Computer Forensics World :: View topic - Two E01 with different MD5, help ~~
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

Two E01 with different MD5, help ~~

 
Post new topic   Reply to topic    Computer Forensics World Forum Index -> General Computer Forensic Issues
View previous topic :: View next topic  
Author Message
chauyiu
Newbie
Newbie


Joined: May 08, 2017
Posts: 1

PostPosted: Mon May 08, 2017 7:54 pm    Post subject: Two E01 with different MD5, help ~~ Reply with quote

Hi all,

I have a case recently and there is a serious problem.

I used Encase 6.18 acquired a laptop hdd (120GB, E01) in 2015 and had 3 "read error" in 3 different sectors.

Then I acquired the hdd again (E01 and dd) in 2017 for court purpose. This time no error occurred.

The MD5 is different since the two E01 is different.
For experiment, I filled in "00" in the 3 "read error" sectors to the dd file by using WinHex (as said from Encase it will zeroed out when error occur), then I calculated the MD5 again, but the MD5s didn't match.

I extracted 700+ files in 2015, and I extracted same files in 2017, the MD5s are matched.

The problem now is, the MD5s of 2 E01 is not matched even though I zeroed out the error sectors in experiment. I have no idea how to explain such issue . Please help ~~
Back to top
View user's profile
Display posts from previous:   
Post new topic   Reply to topic    Computer Forensics World Forum Index -> General Computer Forensic Issues All times are GMT + 10 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Powered by phpBB 2.0.10 © 2001 phpBB Group
phpBB port v2.1 based on Tom Nitzschner's phpbb2.0.6 upgraded to phpBB 2.0.4 standalone was developed and tested by:
ArtificialIntel, ChatServ, mikem,
sixonetonoffun and Paul Laudanski (aka Zhen-Xjell).

Version 2.1 by Nuke Cops 2003 http://www.nukecops.com

Forums ©

 

TMs property of their respective owner. Comments property of posters. 2007 Computer Forensics Science World.
Digital forensic computing news syndication: Computer Forensics Training News or UM Text
Software is copyrighted phpnuke.org (c)2003, and is free under licence agreement. All Rights Are Reserved.