Just a short question..I am restoring a raw image to a larger drive. Why are the hash values different?
Because at least a single bit is different.
A hash match is Yes or No, there is no concept as 'Nearly the same'.
You need to do a binary compare now to see if it is a single byte, or a large number of differences.
If you plugged a drive into a PC without a write blocker, the chances are that a few sectors will be changed.
The calculated hash is a stream hash of the file content. Storing on a different media shouldn't change the hash. Only if you open and save it and don't copy it.
Just a short question..I am restoring a raw image to a larger drive. Why are the hash values different?
How did you do the restore? And how did you calculate the hashes? The details are all and everything here.
It's very often a case of hashing different number of sectors.
(Of course, it could also be because one of the driver has a read or write error, and the software you used didn't tell you. Or something else entirely.)
I had a dd image from a 128 mb usb thumb drive and wanted to restore the image to a larger 1 GB thumbdrive that was zeroed out and compared the hash values between the original and image which were the same but were changed when I restored it to a large drive. I was wondering what would have caused the change? Change in clusters? Just trying to figure it out.
Thank you for the answer(s)
To get the same hash, you need to only hash the data that was restored. Thus, if you restored 128mb (to the sector), then you have to hash only 128mb. When you hash the whole 1 gb drive, that is figured into the calculations (even if they are zeros). Even zeros create a hash.
In linux, you could use dd if=<flash drive> count=<number of sectors> | md5sum
That should work, haven't actually done that personally.
A matching Hash means the two files are identical. Content, length etc, though file name does not matter.
Thus as twjolson says, by changing the sector count, you have changed the file. A 1K file is different to a 1M file, even if the later is zero padded.
As I said in my first post, juts a single bit change means a different hash.
Thank you all that is what I needed to know..thanks for the help