Join Us!

Why are hash values...
 
Notifications
Clear all

Why are hash values different when...  

  RSS
azpctech
(@azpctech)
New Member

Just a short question..I am restoring a raw image to a larger drive. Why are the hash values different?

Quote
Posted : 06/02/2012 12:32 am
mscotgrove
(@mscotgrove)
Senior Member

Because at least a single bit is different.

A hash match is Yes or No, there is no concept as 'Nearly the same'.

You need to do a binary compare now to see if it is a single byte, or a large number of differences.

If you plugged a drive into a PC without a write blocker, the chances are that a few sectors will be changed.

ReplyQuote
Posted : 06/02/2012 12:35 am
Bitstorm
(@bitstorm)
Member

The calculated hash is a stream hash of the file content. Storing on a different media shouldn't change the hash. Only if you open and save it and don't copy it.

ReplyQuote
Posted : 06/02/2012 12:46 am
athulin
(@athulin)
Community Legend

Just a short question..I am restoring a raw image to a larger drive. Why are the hash values different?

How did you do the restore? And how did you calculate the hashes? The details are all and everything here.

It's very often a case of hashing different number of sectors.

(Of course, it could also be because one of the driver has a read or write error, and the software you used didn't tell you. Or something else entirely.)

ReplyQuote
Posted : 06/02/2012 1:55 am
azpctech
(@azpctech)
New Member

I had a dd image from a 128 mb usb thumb drive and wanted to restore the image to a larger 1 GB thumbdrive that was zeroed out and compared the hash values between the original and image which were the same but were changed when I restored it to a large drive. I was wondering what would have caused the change? Change in clusters? Just trying to figure it out.

Thank you for the answer(s)

ReplyQuote
Posted : 06/02/2012 2:00 am
twjolson
(@twjolson)
Active Member

To get the same hash, you need to only hash the data that was restored. Thus, if you restored 128mb (to the sector), then you have to hash only 128mb. When you hash the whole 1 gb drive, that is figured into the calculations (even if they are zeros). Even zeros create a hash.

In linux, you could use dd if= count= | md5sum

That should work, haven't actually done that personally.

ReplyQuote
Posted : 06/02/2012 3:38 am
mscotgrove
(@mscotgrove)
Senior Member

A matching Hash means the two files are identical. Content, length etc, though file name does not matter.

Thus as twjolson says, by changing the sector count, you have changed the file. A 1K file is different to a 1M file, even if the later is zero padded.

As I said in my first post, juts a single bit change means a different hash.

ReplyQuote
Posted : 06/02/2012 2:10 pm
azpctech
(@azpctech)
New Member

Thank you all that is what I needed to know..thanks for the help

ReplyQuote
Posted : 06/02/2012 3:53 pm
Share: