Does anyone have any insight into this. I used ASR SMART to create a hash, then when I created an image of this CDROM in to SMART the hash changed.
Additionally, I used ISOBUSTER to create a hash of my CDROM and I came up with 4 different Hashes.
Any ideas or suggestions.
When working a case and read only media is found, what is the normal process for acquisition and creating a duplicate copy, but at the same time verifying that is exact to the orginal evidence.
Thanks and this is my first post.
I would recommend getting a copy of
So would taking the original evidence and creating an image file as the duplicate be considered forensically sound? I ask because the image most likely will not have a matching hash to the image.
Thanks.