Does this help http://adammooz.wordpress.com/2009/07/14/dcfldds-md5-vs-md5sum/
Steve On 04/02/2010 12:02, shane fail wrote: > Hi, i am looking for any suggestions which will help with the following > issue. > I am trying to image a Western Digital 40gb hard-disk, to be added into > the Autopsy tool as evidence on a case i have manufactured. > The drive is connected via USB as an external drive and being imaged to > the internal hard-disk of a ubuntu server. > I have tried using:- > dd if=/dev/sdg of=/home/sdg.dd bs=512 > dd if=/dev/sdg of=/home/sdg.dd bs=2048 > dcfldd if=/dev/sdg of=/home/sdg.dd > md5sum /dev/sdg > each command returns a different md5 hash. > I have repeated the md5sum command several times between running the > other commands and the md5sum is consistent with this command, so i know > the original disk is not being written to. > the dd and dcfldd commands always return: > "amount of files" +1 files in > "same amount" +1 files out. > The hashes match between device and image file on each occurrence but > none match the result returned by the md5sum command. > > I hope i am being clear enough here, and if anyone could shed some light > on how this would happen, it would be greatly appreciated. > > kind regards, > > shane > > > > > > No virus found in this incoming message. > Checked by AVG - www.avg.com > Version: 9.0.733 / Virus Database: 271.1.1/2666 - Release Date: 02/03/10 > 19:35:00 > > -- Next meeting: Bournemouth, Wed 2010-02-03 20:00 http://dorset.lug.org.uk/ http://www.linkedin.com/groups?gid=2645413 Chat: http://www.mibbit.com/?server=irc.blitzed.org&channel=%23dorset List info: https://mailman.lug.org.uk/mailman/listinfo/dorset
