sleuthkit-users

Re: [sleuthkit-users] MD5Sum Questnion

[Angus M. <an...@n-...>]

Are you sure the drive in question was on hdb on the Suse machine ? 
What result do you get if you boot the Suse machine using Knoppix with the drive
in question on hdb ? 
What sort of partitions and filesystems are on the disk ? 
Have you tried md5sum < /dev/hd[whatever] instead of using the filename. (It
shouldn't matter, but it wouldn't hurt)


On Sat Apr  8 13:31 , Detective David Vitkus <dv...@no...> sent:

>Can anyone explain this one?
>
>I'm examining an 80 Gig hard drive. I started with Knippix 3.6 and took 
>an initial hash with the drive inside the computer and md5sum returned:
>a4d83bac721f9e9cbef44a0f19c9f1d3 /dev/hda
>I installed the drive in another machine (Suse 9.3) for examination and 
>md5sum returns:
>ae319c49dbfc21fd2f392769083bed58 /dev/hdb
>Using knoppix again, I get:
>a4d83bac721f9e9cbef44a0f19c9f1d3 /dev/hda
>
>Any thought would be appeciated.
>
>Thanks,
>
>-- 
>
>David Vitkus
>Detective
>Northampton Police Department
>29 Center St.
>Northampton, MA 01060
>413-587-1133 (voice)
>413-587-1137 (fax)
>
>
>
>-------------------------------------------------------
>This SF.Net email is sponsored by xPML, a groundbreaking scripting language
>that extends applications into web and mobile media. Attend the live webcast
>and join the prime developer group breaking into this new coding territory!
>http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
>_______________________________________________
>sleuthkit-users mailing list
>https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>http://www.sleuthkit.org

RE: [sleuthkit-users] MD5Sum Questnion

[Rich T. <te...@ap...>]

I too, would verify it was actually on /dev/hdb on the Suse machine.  Why would it be /dev/hda on the Suse exam machine (as indicated on the second Knoppix pass).

I only use a firewire connection on my exam machine so its always /dev/sda (or b, c, d etc...).  Did you boot with Knoppix on the host machine before pulling the drive?  What did fdisk -l return on each machine???  I would also compare results from hdpram -I to ensure you are hitting the same drive.




Detective David Vitkus <dv...@no...> wrote: Can anyone explain this one?

I'm examining an 80 Gig hard drive. I started with Knippix 3.6 and took 
an initial hash with the drive inside the computer and md5sum returned:
a4d83bac721f9e9cbef44a0f19c9f1d3 /dev/hda
I installed the drive in another machine (Suse 9.3) for  examination and 
md5sum returns:
ae319c49dbfc21fd2f392769083bed58 /dev/hdb
Using knoppix again, I get:
a4d83bac721f9e9cbef44a0f19c9f1d3 /dev/hda

Any thought would be appeciated.

Thanks,

-- 

David Vitkus
Detective
Northampton Police Department
29 Center St.
Northampton, MA 01060
413-587-1133 (voice)
413-587-1137 (fax)



-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org