Re: [sleuthkit-users] hashing a file system

[Simson G. <si...@ac...>]

On Sep 4, 2014, at 8:51 PM, RB <ao...@gm...> wrote:
> 
> Although md5 is not a subdivisible hash (as Simson pointed out), one
> could conceivably still do a single-pass checksum of a filesystem, the
> tradeoff would be the memory consumption of tens of thousands of
> "simultaneous" checksum calculation states.


This doesn't work unless you are prepared to buffer the later fragments of a file when they appear on disk before earlier fragments. So in the worst case, you need to hold the entire disk in RAM.