Extracted File Hash Different from Report Hash
I'm using Axiom to parse through a media card image and found numerous digital pictures of interest. Axiom carved these pictures from unallocated space. For each picture, Axiom generated an MD5 and SHA1 hash value. I've exported each of the relevant pictures from the image to be used in a later report. However, after exporting the pictures I hashed them all using a separate program and expected the hash values to match the values generated by Axiom but this isn't the case. The artifacts that I extracted all have different hash values. Can someone help me understand what I am missing here?
I've done some further testing using an image which contains both parsed and carved pictures. I am finding that hash values for pictures that have been parsed and extracted out as artifacts match those in Axiom's reporting. However, it is only the carved files that have mismatching hash values after being extracted. Thoughts?
Is Axiom adding data to the end of the file while exporting them out to make them a specific size? The same idea as exporting the logical contents of the file versus exporting the physical contents of the file?
If you have both photos as separate files then you can check the file size. A single byte different in length will be a different hash value. Carving does not always get the correct file size. If the files are the same size, then do a binary file compare and see what the difference is