How to compare hash sets

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • s1022.kim
    Junior Member
    • Aug 2025
    • 3

    #1

    How to compare hash sets

    Hello,

    I am trying to clone a drive with 'Create Drive Image' tool on OSForensics.
    I successfully cloned it and am looking for comparison tool to compare each hashsets to verify the integrity.
    Please let me know how I can compare hash sets.

    Thank you for your help in advance!
  • David (PassMark)
    Administrator
    • Jan 2003
    • 11060

    #2
    Under the options to create an image there two interesting settings.
    1) A hash function option. This can be used check the entire image is correct at any point in the future. If the hash values match the image is good.
    2) A "verify" option (which re-reads the image just created back from the disk to check it against the source image).

    Click image for larger version  Name:	image.png Views:	0 Size:	72.1 KB ID:	59554

    This information is saved as a log file in the destination folder. (with the .info.txt file extension). Here is an example log file for the image above.

    Code:
    Image source: \\.\PhysicalDrive1: Partition 0 [100.00MB WIN95 FAT 32]
    Source Disk Model Number: Samsung SSD 970 PRO 1TB
    Source Disk Serial Number: S5JXNC0N303006K
    Image file name: TestImage.img
    Image file size: 104857600
    Image created on Saturday, 2 August 2025, 9:02:03
    
    Copy method: Direct Sector Copy
    Checksum method: SHA-1
    Checksum source( \\.\PhysicalDrive1: Partition 0 [100.00MB WIN95 FAT 32] ): 81a0a85f9a8bcf0e3a406bc674c031d2f921dd82
    Checksum image ( TestImage.img ): 81a0a85f9a8bcf0e3a406bc674c031d2f921dd82
    
    Secondary Checksum method: MD5
    Checksum source( \\.\PhysicalDrive1: Partition 0 [100.00MB WIN95 FAT 32] ): cb03a555fe7a2b7f11ad611df133aa7a
    Checksum image ( TestImage.img ): cb03a555fe7a2b7f11ad611df133aa7a
    
    Case: JPink
    Examiner Name:
    Description: Test image
    Location/Place: Office​
    You don't need to use a hash "set" for this. As just a single hash value is enough to check the entire image.

    But if for some reason you did need to compare the entire contents of the disk, at a file by file level, between two images you could use the "Signatures" module.

    Comment

    • s1022.kim
      Junior Member
      • Aug 2025
      • 3

      #3
      I cloned a drive via 'Create Forensic Image' > Create Logical Image > Copy to Folder to an external drive.
      In this case, how I can confirm the original data and cloned data are identical?
      For example, if I hash the original drive and has the external drive, would two hash values be same? If so, I appreciate how I can hash each drive on OSForensics.
      Thank you for your help in advance.

      Comment

      • s1022.kim
        Junior Member
        • Aug 2025
        • 3

        #4
        Or could you let me know how I can verify if the data is identical after I run 'Logical Image.'

        Comment

        • David (PassMark)
          Administrator
          • Jan 2003
          • 11060

          #5
          I cloned a drive via 'Create Forensic Image' > Create Logical Image > Copy to Folder to an external drive.
          This is a contradiction.
          If you copied one folder, then you did not in fact clone the drive.

          If you need to compare the entire contents of the disk, folder or logical image, at a file by file level, between two images you could use the "Signatures" module.​

          Comment

          Working...