but that doesn't mean that the counterpart in a trial won't use this hash mismatch to grill you on the stand and attempt to invalidate each and every one of your (BTW perfectly valid) findings
I remember a similar discussion here, it happened five or six years ago. A person suggested a simple solution the use of a hardware write blocker. And now it was demonstrated that even a hardware-based solution can write through a write-blocked port on its own (issue a write command without a corresponding command from a host).
Don't forget that the words quoted are true for a simplified case only.
Yep, and I am still wondering how/why in the meantime you and the Author of the OSFClone didn't manage to come out (together) with an agreed upon/tested/validated solution to that issue.
ONLY to give some background to Suai about the specific matter
https://www.forensicfocus.com/Forums/viewtopic/t=12056/
https://www.forensicfocus.com/Forums/viewtopic/t=16195/
jaclaz