A test asset USB owned for two years and tested frequently has suddenly started outputting a different hash everytime its hashed within a writeblocker. Multiple writeblockers have been used with different versions and models and all produce the same outcome, a different hash every time, so the writeblockers themselves can be ruled out as an issue.
Could anybody explain a reasons for why a USB could suddenly start producing a different hash within a writeblocker even though for two years prior nothing like this occured?
Thanks.
The drive is now failing in some way…
One possible explanation https://
One possible explanation https://
digitalcorpora.org/corpora/disk-images/nps-2014-usb-nondeterministic
But that is a "queer" behaviour that may happen with a brand new stick, while presumably this particular stick having been in use for a couple years the non-deterministic sectors have been written to and thus turned into deterministic ones. ?
The possibility of the stick becoming "bad" seems more likely, though a file compare between two (actually more than two) dumps with different hashes might be needed to check if some sectors (always the same) are "crazy" or if it is a "random" issue of the controller, and also to check if the different sectors sport the "USBC" SCSI command header or are just "random" (which would lead to some form of corruption/defect).
jaclaz
What type of USB drive was it?
Does it support SMART?
https://
Maybe you can check the relocated sector counts?
Otherwise as mentioned above, do two dumps and then do a binary compare.
https://