Re: Not constant sha1sum

Isaac Perez Moncho <[email protected]> Sat, 08 Sep 2007 20:54:30 +0200
Newsgroups gmane.comp.security.forensics
Message-ID <[email protected]>
If hash changes the file had changed.
Hash should be the same for the same file (if not changed) always, if 
not is useless.
What are you doing with this file? You are writing it while hashing?
You can control the access to the file?
Maybe a hide program is accessing it.

En/na LERTI - Paul Vidonne ha escrit:
> Hello all !
>
> Does smb  met the following issue : several hash for an
> unique file ? Of course a big one (4 GB). OS is Linux 
> Fedora. File system EXT3 mounted on a SATA RAID-5 on Adaptec 
> card
>
> Could you enlighten me ?
>
> Exemple :
> [root@spica acquisit]# sha1sum -b 07667-SDH-dd.001
> fe8195547af6d7ce76cd2e44160e06310a964063 *07667-SDH-dd.001
>
> [root@spica acquisit]# sha1sum -b 07667-SDH-dd.001
> e8dde55722ed1f2424fd7bb6246163120c561927 *07667-SDH-dd.001
>
> [root@spica acquisit]# sha1sum -b 07667-SDH-dd.001
> 65f5eb98d33f7ccb1a8a82b0e6d916921c9d97b9 *07667-SDH-dd.001
>
> The best is that the second hash is the good one !
>
> Truly yours,
>
> Paul Vidonne
> --
> LERTI - Laboratoire d'Expertise et de 
>   Recherche de Traces Informatiques
> http://www.lerti.fr +33.4 76 90 54 21
>
>
>
>   


-- 
Isaac Perez Moncho 
GSEC, SSP-GHD, SSP-MPA, Microsoft MCP.
JPL TSolucio S.L
www.tsolucio.com