Evidence Analysis
Before you begin your media examination, create a hash of the copy you made of the original media. Does it agree with the hash of the original? If so, you may proceed. If not, find out why. Perhaps you mounted the copy and allowed some writes to occur. Or perhaps the copy process was flawed. In any case, don’t start the analysis until you have a clean copy (an exact copy of the original media, with the same hash).
checksum
Checksum or hash sum is a method to detect errors in transmission or storage of data to determine if data has been altered. A checksum or hash performs a mathematical calculation on the data involved before it is sent to calculate a unique value conditioned by the content of the data itself. This calculation ...
Get Computer Forensics JumpStart, Second Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
