RE: [sleuthkit-users] MD5Sum Questnion
Brought to you by:
carrier
|
From: Rich T. <te...@ap...> - 2006-04-08 22:41:31
|
I too, would verify it was actually on /dev/hdb on the Suse machine. Why would it be /dev/hda on the Suse exam machine (as indicated on the second Knoppix pass). I only use a firewire connection on my exam machine so its always /dev/sda (or b, c, d etc...). Did you boot with Knoppix on the host machine before pulling the drive? What did fdisk -l return on each machine??? I would also compare results from hdpram -I to ensure you are hitting the same drive. Detective David Vitkus <dv...@no...> wrote: Can anyone explain this one? I'm examining an 80 Gig hard drive. I started with Knippix 3.6 and took an initial hash with the drive inside the computer and md5sum returned: a4d83bac721f9e9cbef44a0f19c9f1d3 /dev/hda I installed the drive in another machine (Suse 9.3) for examination and md5sum returns: ae319c49dbfc21fd2f392769083bed58 /dev/hdb Using knoppix again, I get: a4d83bac721f9e9cbef44a0f19c9f1d3 /dev/hda Any thought would be appeciated. Thanks, -- David Vitkus Detective Northampton Police Department 29 Center St. Northampton, MA 01060 413-587-1133 (voice) 413-587-1137 (fax) ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642 _______________________________________________ sleuthkit-users mailing list https://lists.sourceforge.net/lists/listinfo/sleuthkit-users http://www.sleuthkit.org |