hash error

[pmaloney]

When I create a DD image file using a Tableau T35es forensic bridge, it automatically creates both MD5 and SHA1 hashes. When I check these in OSForensics I get a mismatch error. I made some screen shots, but do not see a way to upload them here; so I will email them to help@passmark.com.

[Michael (Passmark)]

OSFMount mounts individual partitions. If you made a DD image of an entire drive then only the partition portion of it will be mounted and then hashed by the volume hashing function (so even if there was only one partition on the drive, you would still be missing the boot and partition table sectors). A better approach would be to use the file hash function to hash the DD image file directly.

[pmaloney]

The hashes (SHA-1 and MD5) dynamically created by the Tableau bridge and Imager exactly match those generated by OSForensics from the DD file. All is good. THANKS!