RE: [sleuthkit-users] MD5Sum Questnion

[Rich T. <te...@ap...>]

I too, would verify it was actually on /dev/hdb on the Suse machine.  Why would it be /dev/hda on the Suse exam machine (as indicated on the second Knoppix pass).

I only use a firewire connection on my exam machine so its always /dev/sda (or b, c, d etc...).  Did you boot with Knoppix on the host machine before pulling the drive?  What did fdisk -l return on each machine???  I would also compare results from hdpram -I to ensure you are hitting the same drive.




Detective David Vitkus <dv...@no...> wrote: Can anyone explain this one?

I'm examining an 80 Gig hard drive. I started with Knippix 3.6 and took 
an initial hash with the drive inside the computer and md5sum returned:
a4d83bac721f9e9cbef44a0f19c9f1d3 /dev/hda
I installed the drive in another machine (Suse 9.3) for  examination and 
md5sum returns:
ae319c49dbfc21fd2f392769083bed58 /dev/hdb
Using knoppix again, I get:
a4d83bac721f9e9cbef44a0f19c9f1d3 /dev/hda

Any thought would be appeciated.

Thanks,

-- 

David Vitkus
Detective
Northampton Police Department
29 Center St.
Northampton, MA 01060
413-587-1133 (voice)
413-587-1137 (fax)



-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org