Hi, i am looking for any suggestions which will help with the following issue. I am trying to image a Western Digital 40gb hard-disk, to be added into the Autopsy tool as evidence on a case i have manufactured. The drive is connected via USB as an external drive and being imaged to the internal hard-disk of a ubuntu server. I have tried using:- dd if=/dev/sdg of=/home/sdg.dd bs=512 dd if=/dev/sdg of=/home/sdg.dd bs=2048 dcfldd if=/dev/sdg of=/home/sdg.dd md5sum /dev/sdg each command returns a different md5 hash. I have repeated the md5sum command several times between running the other commands and the md5sum is consistent with this command, so i know the original disk is not being written to. the dd and dcfldd commands always return: "amount of files" +1 files in "same amount" +1 files out. The hashes match between device and image file on each occurrence but none match the result returned by the md5sum command.
I hope i am being clear enough here, and if anyone could shed some light on how this would happen, it would be greatly appreciated. kind regards, shane -- The contents of this e-mail (and any attachments) are intended for the named addressee only. It contains information which may be confidential and which may also be legally privileged. If you have received this message in error, please do not copy it, disclose it to any other party or take any action in reliance on it. Please notify us immediately by reply e-mail and then delete it from your system. Any opinion or advice or information contained in this email is not necessarily that of the owners or officers of this company. Please note that neither the company nor the sender accepts any responsibility for viruses and it is your responsibility to scan the email and attachments if any. This electronic mail and all attachments have been scanned for computer virus infections. The company and its subsidiaries reserve the right to monitor and investigate e-mail communications through its computer and communications networks. Ambertec Limited is a company registered in England and Wales No: 3640959 Registration office: 17 Moneyfly Road, Verwood, Dorset VAT registration No: 781 3064 35 -- Next meeting: Bournemouth, Wed 2010-02-03 20:00 http://dorset.lug.org.uk/ http://www.linkedin.com/groups?gid=2645413 Chat: http://www.mibbit.com/?server=irc.blitzed.org&channel=%23dorset List info: https://mailman.lug.org.uk/mailman/listinfo/dorset
