Notifications
Clear all

FTK imager

medeiom
(@medeiom)
New Member

I exported a hash list of two different evidence files into an xls spreadsheet. I noticed that there are repeated hash values. What would cause this?

Thanks

Quote
Topic starter Posted : 30/08/2010 8:15 pm
jhowell920
(@jhowell920)
New Member

Not qiute sure what your question is, but if there are duplicate files on each computer (ie the same downloaded image) then those files would have the same hash value.

ReplyQuote
Posted : 30/08/2010 8:41 pm
medeiom
(@medeiom)
New Member

Sorry for not being clear, but I have two separate unique evidence folders. I add one evidence folder to FTK imager, right click and export hash list in a csv format.
I repeat these steps for my second evidence folder.

Now, I then import these two unique csv files into an Excel spreadsheet which puts them in nice columns.

But when I view one of them, it has some repeated hash values.

Hope this helps and thanks for your reply.

ReplyQuote
Topic starter Posted : 30/08/2010 8:48 pm
douglasbrush
(@douglasbrush)
Senior Member

Empty files. OS files. Program files. Lots of others.

"Know" hashes are the basis of de-NISTing data.

http//www.nsrl.nist.gov/

ReplyQuote
Posted : 30/08/2010 9:06 pm
Share:
Share to...