Not constant sha1sum

LERTI - Paul Vidonne <[email protected]> Sat, 08 Sep 2007 10:33:38 +0200

Newsgroups	gmane.comp.security.forensics
Message-ID	<[email protected]>

Hello all !

Does smb  met the following issue : several hash for an
unique file ? Of course a big one (4 GB). OS is Linux 
Fedora. File system EXT3 mounted on a SATA RAID-5 on Adaptec 
card

Could you enlighten me ?

Exemple :
[root@spica acquisit]# sha1sum -b 07667-SDH-dd.001
fe8195547af6d7ce76cd2e44160e06310a964063 *07667-SDH-dd.001

[root@spica acquisit]# sha1sum -b 07667-SDH-dd.001
e8dde55722ed1f2424fd7bb6246163120c561927 *07667-SDH-dd.001

[root@spica acquisit]# sha1sum -b 07667-SDH-dd.001
65f5eb98d33f7ccb1a8a82b0e6d916921c9d97b9 *07667-SDH-dd.001

The best is that the second hash is the good one !

Truly yours,

Paul Vidonne
--
LERTI - Laboratoire d'Expertise et de 
  Recherche de Traces Informatiques
http://www.lerti.fr +33.4 76 90 54 21