Hi,
I am working on one of the nist challenges, I am using the new autopsy 3 beta, so far so good. Up until this point I had been using autopsy 2 on single file dd images. The hashes were presented in a easy to find location. Now I am unsure if it's me or the beta, but I can't find a calculated volume hash value, that and I am unsure how I could do that in command for a collection of E01 files. Any help in either case would be great. Thanks. ?
SO, just to add to this. I used FTK imager to verify the hash, but I still would like to know if this could be done by a command prompt option or from autopsy 3 if anyone knows.
I have to say that from your initial posting is quite unclear to me what you're asking.
If you mean by "volume hash value" the integrity hash of the data in the set of EWF files (E01, E02, …) e.g. MD5 and/or SHA1
You can run ewfverify of the libewf project to verify a set of EWF files from the command line
http//
Yes, I believe that is what I was trying to say. I will definitely check this out. Thank you.