Re: Not constant sha1sum
Isaac Perez Moncho <[email protected]> Sat, 08 Sep 2007 20:54:30 +0200
| Newsgroups | gmane.comp.security.forensics |
|---|---|
| Message-ID | <[email protected]> |
If hash changes the file had changed. Hash should be the same for the same file (if not changed) always, if not is useless. What are you doing with this file? You are writing it while hashing? You can control the access to the file? Maybe a hide program is accessing it. En/na LERTI - Paul Vidonne ha escrit: > Hello all ! > > Does smb met the following issue : several hash for an > unique file ? Of course a big one (4 GB). OS is Linux > Fedora. File system EXT3 mounted on a SATA RAID-5 on Adaptec > card > > Could you enlighten me ? > > Exemple : > [root@spica acquisit]# sha1sum -b 07667-SDH-dd.001 > fe8195547af6d7ce76cd2e44160e06310a964063 *07667-SDH-dd.001 > > [root@spica acquisit]# sha1sum -b 07667-SDH-dd.001 > e8dde55722ed1f2424fd7bb6246163120c561927 *07667-SDH-dd.001 > > [root@spica acquisit]# sha1sum -b 07667-SDH-dd.001 > 65f5eb98d33f7ccb1a8a82b0e6d916921c9d97b9 *07667-SDH-dd.001 > > The best is that the second hash is the good one ! > > Truly yours, > > Paul Vidonne > -- > LERTI - Laboratoire d'Expertise et de > Recherche de Traces Informatiques > http://www.lerti.fr +33.4 76 90 54 21 > > > > -- Isaac Perez Moncho GSEC, SSP-GHD, SSP-MPA, Microsoft MCP. JPL TSolucio S.L www.tsolucio.com