Join Us!

USB Hash value keep...
 
Notifications
Clear all

USB Hash value keeps changing within writeblocker  

  RSS
Carter907
(@carter907)
New Member

A test asset USB owned for two years and tested frequently has suddenly started outputting a different hash everytime its hashed within a writeblocker. Multiple writeblockers have been used with different versions and models and all produce the same outcome, a different hash every time, so the writeblockers themselves can be ruled out as an issue.

Could anybody explain a reasons for why a USB could suddenly start producing a different hash within a writeblocker even though for two years prior nothing like this occured?

Thanks.

Quote
Posted : 02/12/2019 1:30 pm
Rich2005
(@rich2005)
Active Member

The drive is now failing in some way…

ReplyQuote
Posted : 02/12/2019 1:47 pm
thefuf
(@thefuf)
Active Member

One possible explanation https://digitalcorpora.org/corpora/disk-images/nps-2014-usb-nondeterministic

ReplyQuote
Posted : 02/12/2019 2:50 pm
jaclaz
(@jaclaz)
Community Legend

One possible explanation https://digitalcorpora.org/corpora/disk-images/nps-2014-usb-nondeterministic

But that is a "q***r" behaviour that may happen with a brand new stick, while presumably this particular stick having been in use for a couple years the non-deterministic sectors have been written to and thus turned into deterministic ones. ?

The possibility of the stick becoming "bad" seems more likely, though a file compare between two (actually more than two) dumps with different hashes might be needed to check if some sectors (always the same) are "crazy" or if it is a "random" issue of the controller, and also to check if the different sectors sport the "USBC" SCSI command header or are just "random" (which would lead to some form of corruption/defect).

jaclaz

ReplyQuote
Posted : 02/12/2019 4:54 pm
Passmark
(@passmark)
Active Member

What type of USB drive was it?
Does it support SMART?
https://en.wikipedia.org/wiki/S.M.A.R.T.
Maybe you can check the relocated sector counts?

Otherwise as mentioned above, do two dumps and then do a binary compare.
https://www.computerhope.com/unix/ucmp.htm

ReplyQuote
Posted : 03/12/2019 2:14 am
Share: