Two E01 with different MD5, help ~~

  • We encourage our users to use Real Names to build a real community, friendships and networking opportunities.

    [more information]

chauyiu

New Member
May 7, 2017
3
0
#1
Hi all,

I have a case recently and there is a serious problem.

I used Encase 6.18 acquired a laptop hdd (120GB, E01) in 2015 and had 3 "read error" in 3 different sectors.

Then I acquired the hdd again (E01 and dd) in 2017 for court purpose. This time no error occurred.

The MD5 is different since the two E01 is different.
For experiment, I filled in "00" in the 3 "read error" sectors to the dd file by using WinHex (as said from Encase it will zeroed out when error occur), then I calculated the MD5 again, but the MD5s didn't match.

I extracted 700+ files in 2015, and I extracted same files in 2017, the MD5s are matched.

The problem now is, the MD5s of 2 E01 is not matched even though I zeroed out the error sectors in experiment. I have no idea how to explain such issue . Please help ~~
 

About us

  • Our community began in 2004. Since this time, we have grown to have over 29,000+ members within the DFIR & Cyber Security community.

    We are happy to announce that this forum is now under new ownership with the goal to once again become the main Digital Forensics Forum on the internet for DFIR, OSINT and Cyber Security.

    If you can think of ways to help us improve, please let us know.

    We pride ourselves on offering unbiased, critical discussion among people of all different backgrounds.

    We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu