Posted: Mon May 08, 2017 7:54 pm Post subject: Two E01 with different MD5, help ~~
I have a case recently and there is a serious problem.
I used Encase 6.18 acquired a laptop hdd (120GB, E01) in 2015 and had 3 "read error" in 3 different sectors.
Then I acquired the hdd again (E01 and dd) in 2017 for court purpose. This time no error occurred.
The MD5 is different since the two E01 is different.
For experiment, I filled in "00" in the 3 "read error" sectors to the dd file by using WinHex (as said from Encase it will zeroed out when error occur), then I calculated the MD5 again, but the MD5s didn't match.
I extracted 700+ files in 2015, and I extracted same files in 2017, the MD5s are matched.
The problem now is, the MD5s of 2 E01 is not matched even though I zeroed out the error sectors in experiment. I have no idea how to explain such issue . Please help ~~
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum