±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36317
New Yesterday: 0 Visitors: 164

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

USB Hash value keeps changing within writeblocker

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Carter907
Newbie
 

USB Hash value keeps changing within writeblocker

Post Posted: Dec 02, 19 13:30

A test asset USB owned for two years and tested frequently has suddenly started outputting a different hash everytime its hashed within a writeblocker. Multiple writeblockers have been used with different versions and models and all produce the same outcome, a different hash every time, so the writeblockers themselves can be ruled out as an issue.

Could anybody explain a reasons for why a USB could suddenly start producing a different hash within a writeblocker even though for two years prior nothing like this occured?

Thanks.  
 
  

Rich2005
Senior Member
 

Re: USB Hash value keeps changing within writeblocker

Post Posted: Dec 02, 19 13:47

The drive is now failing in some way...  
 
  

thefuf
Senior Member
 

Re: USB Hash value keeps changing within writeblocker

Post Posted: Dec 02, 19 14:50

One possible explanation: digitalcorpora.org/cor...erministic  
 
  

jaclaz
Senior Member
 

Re: USB Hash value keeps changing within writeblocker

Post Posted: Dec 02, 19 16:54

- thefuf
One possible explanation: digitalcorpora.org/cor...erministic


But that is a "queer" behaviour that may happen with a brand new stick, while presumably this particular stick having been in use for a couple years the non-deterministic sectors have been written to and thus turned into deterministic ones. Confused

The possibility of the stick becoming "bad" seems more likely, though a file compare between two (actually more than two) dumps with different hashes might be needed to check if some sectors (always the same) are "crazy" or if it is a "random" issue of the controller, and also to check if the different sectors sport the "USBC" SCSI command header or are just "random" (which would lead to some form of corruption/defect).

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

Passmark
Senior Member
 

Re: USB Hash value keeps changing within writeblocker

Post Posted: Dec 03, 19 02:14

What type of USB drive was it?
Does it support SMART?
en.wikipedia.org/wiki/S.M.A.R.T.
Maybe you can check the relocated sector counts?

Otherwise as mentioned above, do two dumps and then do a binary compare.
www.computerhope.com/unix/ucmp.htm  
 

Page 1 of 1