Why are hash values...
 
Notifications
Clear all

Why are hash values different when...

8 Posts
5 Users
0 Likes
677 Views
(@azpctech)
Posts: 4
New Member
Topic starter
 

Just a short question..I am restoring a raw image to a larger drive. Why are the hash values different?

 
Posted : 06/02/2012 12:32 am
(@mscotgrove)
Posts: 938
Prominent Member
 

Because at least a single bit is different.

A hash match is Yes or No, there is no concept as 'Nearly the same'.

You need to do a binary compare now to see if it is a single byte, or a large number of differences.

If you plugged a drive into a PC without a write blocker, the chances are that a few sectors will be changed.

 
Posted : 06/02/2012 12:35 am
(@bitstorm)
Posts: 53
Trusted Member
 

The calculated hash is a stream hash of the file content. Storing on a different media shouldn't change the hash. Only if you open and save it and don't copy it.

 
Posted : 06/02/2012 12:46 am
(@athulin)
Posts: 1156
Noble Member
 

Just a short question..I am restoring a raw image to a larger drive. Why are the hash values different?

How did you do the restore? And how did you calculate the hashes? The details are all and everything here.

It's very often a case of hashing different number of sectors.

(Of course, it could also be because one of the driver has a read or write error, and the software you used didn't tell you. Or something else entirely.)

 
Posted : 06/02/2012 1:55 am
(@azpctech)
Posts: 4
New Member
Topic starter
 

I had a dd image from a 128 mb usb thumb drive and wanted to restore the image to a larger 1 GB thumbdrive that was zeroed out and compared the hash values between the original and image which were the same but were changed when I restored it to a large drive. I was wondering what would have caused the change? Change in clusters? Just trying to figure it out.

Thank you for the answer(s)

 
Posted : 06/02/2012 2:00 am
(@twjolson)
Posts: 417
Honorable Member
 

To get the same hash, you need to only hash the data that was restored. Thus, if you restored 128mb (to the sector), then you have to hash only 128mb. When you hash the whole 1 gb drive, that is figured into the calculations (even if they are zeros). Even zeros create a hash.

In linux, you could use dd if=<flash drive> count=<number of sectors> | md5sum

That should work, haven't actually done that personally.

 
Posted : 06/02/2012 3:38 am
(@mscotgrove)
Posts: 938
Prominent Member
 

A matching Hash means the two files are identical. Content, length etc, though file name does not matter.

Thus as twjolson says, by changing the sector count, you have changed the file. A 1K file is different to a 1M file, even if the later is zero padded.

As I said in my first post, juts a single bit change means a different hash.

 
Posted : 06/02/2012 2:10 pm
(@azpctech)
Posts: 4
New Member
Topic starter
 

Thank you all that is what I needed to know..thanks for the help

 
Posted : 06/02/2012 3:53 pm
Share: