Re: [sleuthkit-users] Just a question regarding Image Integrity

[Brian C. <ca...@sl...>]

Hashes are used in several places.  For lookup, we focus on MD5 since that is what most hash databases use.  SHA-1 is around the corner though. 

For image integrity, then it is up to the image format (i.e. E01) or the user having the hash value out of band (i.e. written down somewhere) if it is a raw image.  We use MD5 for the E01 verification.  We don't currently provide a way to get the hash of an entire raw image from within Autopsy.



On Nov 7, 2014, at 5:20 AM, Dean Baculio <dea...@ya...> wrote:

> I have been using Autopsy and was fiddling around with it just to see how things work compared to what we used in uni which is the FTK toolkit 5.5
> 
> Everything seems to be working well, except for one thing though, image integrity. What hashing hashing method did you guys use? It says on the website its MD5, but it seemed outdated. 
> So I just want to confirm whether or not its using MD5 or if you guys updated and to using MD6 but I wont know since it only shows this:
> 
> Link to screenshot: Screenshot by Gyazo
>  
>  
> 
>  
>  
>  
>  
>  
> Screenshot by Gyazo
> Gyazo lets you instantly grab the screen and upload the image to the web.
> View on gyazo.com
> Preview by Yahoo
>  
> 
> Which doesnt tell me what  hash function it uses :[
> 
> Hope I would get a reply, thanks!
> ------------------------------------------------------------------------------
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org