Announcement

Collapse
No announcement yet.

How to compare hash sets

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • How to compare hash sets

    Hello,

    I am trying to clone a drive with 'Create Drive Image' tool on OSForensics.
    I successfully cloned it and am looking for comparison tool to compare each hashsets to verify the integrity.
    Please let me know how I can compare hash sets.

    Thank you for your help in advance!

  • #2
    Under the options to create an image there two interesting settings.
    1) A hash function option. This can be used check the entire image is correct at any point in the future. If the hash values match the image is good.
    2) A "verify" option (which re-reads the image just created back from the disk to check it against the source image).

    Click image for larger version  Name:	image.png Views:	0 Size:	72.1 KB ID:	59554

    This information is saved as a log file in the destination folder. (with the .info.txt file extension). Here is an example log file for the image above.

    Code:
    Image source: \\.\PhysicalDrive1: Partition 0 [100.00MB WIN95 FAT 32]
    Source Disk Model Number: Samsung SSD 970 PRO 1TB
    Source Disk Serial Number: S5JXNC0N303006K
    Image file name: TestImage.img
    Image file size: 104857600
    Image created on Saturday, 2 August 2025, 9:02:03
    
    Copy method: Direct Sector Copy
    Checksum method: SHA-1
    Checksum source( \\.\PhysicalDrive1: Partition 0 [100.00MB WIN95 FAT 32] ): 81a0a85f9a8bcf0e3a406bc674c031d2f921dd82
    Checksum image ( TestImage.img ): 81a0a85f9a8bcf0e3a406bc674c031d2f921dd82
    
    Secondary Checksum method: MD5
    Checksum source( \\.\PhysicalDrive1: Partition 0 [100.00MB WIN95 FAT 32] ): cb03a555fe7a2b7f11ad611df133aa7a
    Checksum image ( TestImage.img ): cb03a555fe7a2b7f11ad611df133aa7a
    
    Case: JPink
    Examiner Name:
    Description: Test image
    Location/Place: Office​
    You don't need to use a hash "set" for this. As just a single hash value is enough to check the entire image.

    But if for some reason you did need to compare the entire contents of the disk, at a file by file level, between two images you could use the "Signatures" module.

    Comment


    • #3
      I cloned a drive via 'Create Forensic Image' > Create Logical Image > Copy to Folder to an external drive.
      In this case, how I can confirm the original data and cloned data are identical?
      For example, if I hash the original drive and has the external drive, would two hash values be same? If so, I appreciate how I can hash each drive on OSForensics.
      Thank you for your help in advance.

      Comment


      • #4
        Or could you let me know how I can verify if the data is identical after I run 'Logical Image.'

        Comment


        • #5
          I cloned a drive via 'Create Forensic Image' > Create Logical Image > Copy to Folder to an external drive.
          This is a contradiction.
          If you copied one folder, then you did not in fact clone the drive.

          If you need to compare the entire contents of the disk, folder or logical image, at a file by file level, between two images you could use the "Signatures" module.​

          Comment

          Working...
          X