±Forensic Focus Partners
±Your Account

![]() |
![]() |
![]() |
![]() |
±Latest Articles
±Latest Videos
±Latest Jobs
Back to top
Skip to content
Skip to menu
Back to top
Back to main
Skip to menu
But that is a "queer" behaviour that may happen with a brand new stick, while presumably this particular stick having been in use for a couple years the non-deterministic sectors have been written to and thus turned into deterministic ones.
The possibility of the stick becoming "bad" seems more likely, though a file compare between two (actually more than two) dumps with different hashes might be needed to check if some sectors (always the same) are "crazy" or if it is a "random" issue of the controller, and also to check if the different sectors sport the "USBC" SCSI command header or are just "random" (which would lead to some form of corruption/defect).
jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. -
USB Hash value keeps changing within writeblocker
-
Carter907 - Newbie
USB Hash value keeps changing within writeblocker
A test asset USB owned for two years and tested frequently has suddenly started outputting a different hash everytime its hashed within a writeblocker. Multiple writeblockers have been used with different versions and models and all produce the same outcome, a different hash every time, so the writeblockers themselves can be ruled out as an issue.
Could anybody explain a reasons for why a USB could suddenly start producing a different hash within a writeblocker even though for two years prior nothing like this occured?
Thanks.
Could anybody explain a reasons for why a USB could suddenly start producing a different hash within a writeblocker even though for two years prior nothing like this occured?
Thanks.
-
Rich2005 - Senior Member
-
thefuf - Senior Member
Re: USB Hash value keeps changing within writeblocker
One possible explanation: digitalcorpora.org/cor...erministic
-
jaclaz - Senior Member
Re: USB Hash value keeps changing within writeblocker
- thefufOne possible explanation: digitalcorpora.org/cor...erministic
But that is a "queer" behaviour that may happen with a brand new stick, while presumably this particular stick having been in use for a couple years the non-deterministic sectors have been written to and thus turned into deterministic ones.

The possibility of the stick becoming "bad" seems more likely, though a file compare between two (actually more than two) dumps with different hashes might be needed to check if some sectors (always the same) are "crazy" or if it is a "random" issue of the controller, and also to check if the different sectors sport the "USBC" SCSI command header or are just "random" (which would lead to some form of corruption/defect).
jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. -
-
Passmark - Senior Member
Re: USB Hash value keeps changing within writeblocker
What type of USB drive was it?
Does it support SMART?
en.wikipedia.org/wiki/S.M.A.R.T.
Maybe you can check the relocated sector counts?
Otherwise as mentioned above, do two dumps and then do a binary compare.
www.computerhope.com/unix/ucmp.htm
Does it support SMART?
en.wikipedia.org/wiki/S.M.A.R.T.
Maybe you can check the relocated sector counts?
Otherwise as mentioned above, do two dumps and then do a binary compare.
www.computerhope.com/unix/ucmp.htm