USB Hash value keep...
 
Notifications
Clear all

USB Hash value keeps changing within writeblocker

5 Posts
5 Users
0 Likes
795 Views
(@c17025)
Posts: 16
Active Member
Topic starter
 

A test asset USB owned for two years and tested frequently has suddenly started outputting a different hash everytime its hashed within a writeblocker. Multiple writeblockers have been used with different versions and models and all produce the same outcome, a different hash every time, so the writeblockers themselves can be ruled out as an issue.

Could anybody explain a reasons for why a USB could suddenly start producing a different hash within a writeblocker even though for two years prior nothing like this occured?

Thanks.

 
Posted : 02/12/2019 1:30 pm
(@rich2005)
Posts: 535
Honorable Member
 

The drive is now failing in some way…

 
Posted : 02/12/2019 1:47 pm
(@thefuf)
Posts: 262
Reputable Member
 

One possible explanation https://digitalcorpora.org/corpora/disk-images/nps-2014-usb-nondeterministic

 
Posted : 02/12/2019 2:50 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

One possible explanation https://digitalcorpora.org/corpora/disk-images/nps-2014-usb-nondeterministic

But that is a "queer" behaviour that may happen with a brand new stick, while presumably this particular stick having been in use for a couple years the non-deterministic sectors have been written to and thus turned into deterministic ones. ?

The possibility of the stick becoming "bad" seems more likely, though a file compare between two (actually more than two) dumps with different hashes might be needed to check if some sectors (always the same) are "crazy" or if it is a "random" issue of the controller, and also to check if the different sectors sport the "USBC" SCSI command header or are just "random" (which would lead to some form of corruption/defect).

jaclaz

 
Posted : 02/12/2019 4:54 pm
Passmark
(@passmark)
Posts: 376
Reputable Member
 

What type of USB drive was it?
Does it support SMART?
https://en.wikipedia.org/wiki/S.M.A.R.T.
Maybe you can check the relocated sector counts?

Otherwise as mentioned above, do two dumps and then do a binary compare.
https://www.computerhope.com/unix/ucmp.htm

 
Posted : 03/12/2019 2:14 am
Share: