Switch to full style
Anything related to computer forensics (new section!)
Post a reply

Re: Forensic Image Hash

June 27th, 2018, 15:11

But ... even if on the fly it is faster, hashing what ? One sector a time ? One megabyte ? And do what with the hash(es) ? Store them alongside or just present to the user ?

Okay, you can keep running the calculations for the hash and keep feeding the bytes read to the polynomial calculation of your specific hash method. It would probably avoid some time at the end of the cloning to read the image and calculate the hash. But, would it enough to justify the increased complexity ?

Re: Forensic Image Hash

June 27th, 2018, 15:25

rogfanther wrote:Okay, you can keep running the calculations for the hash and keep feeding the bytes read to the polynomial calculation of your specific hash method. It would probably avoid some time at the end of the cloning to read the image and calculate the hash. But, would it enough to justify the increased complexity ?

THAT is the magic question :mrgreen:

Re: Forensic Image Hash

June 27th, 2018, 15:31

Let me rephrase the magic question:
Would adding this feature to the pro version in any way help to sell HDDSuperClone? THAT is the real magic question that will drive whether or not I do it. Would the return be worth the effort? :?

Re: Forensic Image Hash

June 27th, 2018, 15:41

maximus wrote:Let me rephrase the magic question:
Would adding this feature to the pro version in any way help to sell HDDSuperClone? THAT is the real magic question that will drive whether or not I do it. Would the return be worth the effort? :?


I don't think so because the HDDSuperClone strong points is to be an alternative to hardware sollutions to clone BAD drives and the hashing would be a strong point to use when imaging GOOD DRIVES !!!

If you were to be using the tool to image a drive without a single bad sector hashing would be ok as you would read the sector and you would create the hash on the fly avoiding extra time to re-read sectors to re-calculate the hash.

This wouldn't apply to a tool made to recover data out of bad sectors.

HDDSuperTool strong point is to be able to extract "more data" out of damaged drive. And it doesn't make sense to compare hashes of images done by several tools as you would get a diferent hash even if just a single byte were to be diferent on the image. If your tool gets more data the hash would be diferent from the one generated by another tool as well.

This would only make sense for 100% working drives where you would image, copy the image over to another person and that person were to need to verify that the "image" were exactly the same as the one produced by you.

Re: Forensic Image Hash

June 27th, 2018, 15:45

That would be better to the three people who asked for it to answer.

Just an opinion, but pc3k doesn´t have it. Maybe they considered and then decided to focus on the main purpose of fixing hard drives.

Maybe add an option to calculate a md5sum of the created image after done cloning ?

Re: Forensic Image Hash

June 27th, 2018, 15:47

rogfanther wrote:Maybe add an option to calculate a md5sum of the created image after done cloning ?


That would take a huge amount of time to re-process the image/clone and the user could just use any other tool available on the market to calculate the hash ...

Re: Forensic Image Hash

June 27th, 2018, 16:07

rogfanther wrote:Maybe add an option to calculate a md5sum of the created image after done cloning ?

Yeah, something like:
Type one of the following commands to hash the image on your own using built in Linux commands so I don't have to deal with it:
md5sum -b imagefilename
sha1sum -b imagefilename
:mrgreen:

Re: Forensic Image Hash

June 27th, 2018, 16:12

rogfanther wrote:That would be better to the three people who asked for it to answer.

Maybe I will get ambitious enough to go back through my emails and find them, and ask a few questions. Maybe...

Re: Forensic Image Hash

June 27th, 2018, 16:20

maximus wrote:
rogfanther wrote:Maybe add an option to calculate a md5sum of the created image after done cloning ?

Yeah, something like:
Type one of the following commands to hash the image on your own using built in Linux commands so I don't have to deal with it:
md5sum -b imagefilename
sha1sum -b imagefilename
:mrgreen:


Sounds nice !

:mrgreen: :mrgreen: :mrgreen:

This would only make sense to save time and in the context of 100% working drives without a single bad sector and hash on the fly (while reading to do the image).
Post a reply