Hi Folks,
I am trying to teach myself a bit about drive imaging and I have been playing around with Helix.
I have successfully imaged a hard drive to a samba share but had a few problems with hashes.
I have been doing the following
md5sum of drive to be imaged
dd image of drive to samba share
md5sum of image created.
I was hoping that the hashes would match but every time I do it they are different.
The commands I am using are
md5sum /dev/sda1 > /mnt/share/drive.md5
dd if=/dev/sda1 of=/mnt/share/image.img
md5sum /mnt/share/imgae.img > /mnt/share/image.md5
Am I missing something?
Thanks
Jon
Other than referencing the wrong file in your third command "md5sum /mnt/share/imgae.img".
One thing to consider - bad sectors on /dev/sda1. Depending upon size of the drive try imaging in 100 meg segments or use the conv=noerror,sync option. The output should contain an error message concerning reading the bad block. The partially read block will be filled with nulls.
Check out Dcfldd http//dcfldd.sourceforge.net/ far superior than plain dd.