Hard disks comparing

Why not just hash the drives before and after, if there is a hash mismatch you know you have a problem somewhere.

What tool is it you are testing?

If you do as CaptainF says, do make sure you hash the exact number of sectors on both disks.

The problem with hashing is the answer is Yes or NO. It will not distinguish between a single bit difference or 5GB of data different.

If you do as CaptainF says, do make sure you hash the exact number of sectors on both disks.

The problem with hashing is the answer is Yes or NO. It will not distinguish between a single bit difference or 5GB of data different.

Yep, the problem with comparing two hard disks is that unless they are EXACTLY the same make/model it is VERY likely [sic, recte possible] they will have a different number of sectors.

It depends on the actual *use* you have for the compare, if it is just to check that the cloning suceeded, you may want to compare separately the MBR's and then hash the actual partitions/volumes/filesystems (please read as "whatever gets a drive letter").

jaclaz

Thanx guys for answers )

Why not just hash the drives before and after, if there is a hash mismatch you know you have a problem somewhere.

Definitely right but I have got only two drives the source and its clone made by somebody else.
I'm just gonna check it is it the real copy or not.

If you do as CaptainF says, do make sure you hash the exact number of sectors on both disks.

And here is the problem because the clone has been done on different disk (producer and bigger size).

Yep, the problem with comparing two hard disks is that unless they are EXACTLY the same make/model it is VERY likely they will have a different number of sectors.

So here is the reason I'm asking as hashing doesn't help in this case (
This is why I am looking for any tool which can compare sector by sector both disks

Yep, the problem with comparing two hard disks is that unless they are EXACTLY the same make/model it is VERY likely they will have a different number of sectors.jaclaz

You sure? - my experience for a long while now is that take any two drives from different maufacturers and you will get the same sector count for drives of the same capacity. To verify I just grabbed two 500GB drives (a Hitachi and a Seagate) at random and both had 976,773,168 sectors each.

Even if the drives have a different number of sectors, just use DD and specify the sector count to match your source, and then pipe it to md5sum. Assuming that you properly prepared your destination drive by zeroing out and verifying, it can be any size you want, have a matching hash across the sector count and be a valid forensic copy.

Yep, the problem with comparing two hard disks is that unless they are EXACTLY the same make/model it is VERY likely they will have a different number of sectors.jaclaz

You sure? - my experience for a long while now is that take any two drives from different maufacturers and you will get the same sector count for drives of the same capacity. To verify I just grabbed two 500GB drives (a Hitachi and a Seagate) at random and both had 976,773,168 sectors each.

I would call that a "collision". roll

If you prefer I can take back the "VERY likely" and re-issue it as "possible" wink , I distinctly remember having seen different makes/models of "same label capacity" hard disks with slightly different sector count, but I gladly take your word for it that newish "high capacity" drives from different manufacturers tend now to have same exact sector count, probably because every manufacturer is "copying the other" and there are some "technical constraints".

In any case it won't apply to the particular problem of OP since the two drives are ALSO different in size. 😯

@Ricco
Maybe you missed the point.
A DISK (whole disk) is made of

1. "hidden" sectors (of which the first one is the MBR)
2. one or more partitions/volumes (normally called "drives", as said "the things that get a drive letter"
3. extra (unused) space after last partition/volume

[/listo]

If you compare one by one each corresponding "element" in the above list, you will have the certainty that for all common uses BUT forensics, the clone was succesful.
Since the MBR is first sector and each partition/volume can be hashed as "LogicalDrive", and you don't need/use the other (usually 62 or 2047) hidden sectors nor the "extra" space, the clone will certainly be a "good enough" clone, and you need not to find out the exact size of the source disk to have the parameter to give DD or similar utility.

If you did not clone yourself the disk, depending on the way it was imaged/ cloned originally and EXPECIALLY if target drive was not "wiped/sanitized" before, you may get hash differences due to either the "hidden sectors" or the "extra" sectors.

Should you be using Windows, you can use the dsfi from the dsfok toolkit as detailed here
http//reboot.pro/5000/page__st__1
on the source disk as it will give you both the exact size (in bytes) and the MD5.
You just divide the size by 512 and use it for hashing the "target" disk instead of the second "0".

Under Linux a good alternative to dd may be dcfldd
http//dcfldd.sourceforge.net/
http//osdir.com/ml/security.forensics/2006-02/msg00014.html
http//osdir.com/ml/security.forensics/2006-02/msg00029.html
and it's "hashwindow" feature this way you have "partial hashes" too.

jaclaz

I've run into many dries where one is 121Gb and another 120GB for example.

yes,
if u thinking that the same sector to be contain same consist, you must be aware of ur destination also same firmware with ur souree…