Flash drives and acquisition

by Dominik Weber

“Take a look at this”. It started simply with that. A co-worker was looking into some strange issue with an acquisition of a flash drive. It seemed that the acquisition hash changed every time the drive was acquired. The write switch was off. Even a software or hardware write blocker did not prevent this odd effect. My co-worker did isolate some sector differences between the individual acquisitions. She found out that it was a series of sectors located in “Unallocated Clusters”. Then we used a disk editor to read the same sector and the same behavior persisted. Same results with other tools. On different computers…"