Forums
Main Category
General (Technical,...
USB Hash value keep...
 
Notifications
Clear all

USB Hash value keeps changing within writeblocker

 
General (Technical, Procedural, Software, Hardware etc.)
Last Post by Passmark 6 years ago
5 Posts
5 Users
0 Reactions
1,252 Views
RSS
 C17025
(@c17025)
Active Member
Joined: 6 years ago
Posts: 16
Topic starter 02/12/2019 2:30 pm  

A test asset USB owned for two years and tested frequently has suddenly started outputting a different hash everytime its hashed within a writeblocker. Multiple writeblockers have been used with different versions and models and all produce the same outcome, a different hash every time, so the writeblockers themselves can be ruled out as an issue.

Could anybody explain a reasons for why a USB could suddenly start producing a different hash within a writeblocker even though for two years prior nothing like this occured?

Thanks.


   
Quote
 Rich2005
(@rich2005)
Honorable Member
Joined: 19 years ago
Posts: 541
02/12/2019 2:47 pm  

The drive is now failing in some way…


   
ReplyQuote
 thefuf
(@thefuf)
Reputable Member
Joined: 17 years ago
Posts: 262
02/12/2019 3:50 pm  

One possible explanation https://digitalcorpora.org/corpora/disk-images/nps-2014-usb-nondeterministic


   
ReplyQuote
jaclaz
 jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
02/12/2019 5:54 pm  

One possible explanation https://digitalcorpora.org/corpora/disk-images/nps-2014-usb-nondeterministic

But that is a "queer" behaviour that may happen with a brand new stick, while presumably this particular stick having been in use for a couple years the non-deterministic sectors have been written to and thus turned into deterministic ones. ?

The possibility of the stick becoming "bad" seems more likely, though a file compare between two (actually more than two) dumps with different hashes might be needed to check if some sectors (always the same) are "crazy" or if it is a "random" issue of the controller, and also to check if the different sectors sport the "USBC" SCSI command header or are just "random" (which would lead to some form of corruption/defect).

jaclaz


   
ReplyQuote
Passmark
 Passmark
(@passmark)
Reputable Member
Joined: 14 years ago
Posts: 376
03/12/2019 3:14 am  

What type of USB drive was it?
Does it support SMART?
https://en.wikipedia.org/wiki/S.M.A.R.T.
Maybe you can check the relocated sector counts?

Otherwise as mentioned above, do two dumps and then do a binary compare.
https://www.computerhope.com/unix/ucmp.htm


   
ReplyQuote
Forum Jump:
  Previous Topic
Next Topic  
Share: