Hashing is Important in Digital Forensics

FTK imager will not output hash value and verify hash value  for DVD & CD
So, ....
First -  Verify Hash for Original DVD and Take Screen Shoot ,I Check Again and Again
for surely hash Values ..



Second  -  make DVD disk image and FTK will output isoBuster CUE Format , Next  I Verify Image file for Hash Value , Now Original DVD hash Value and Image Hash Value.So, We got 2 hash Value.  One for Original DVD hash value ,Next Hash Value for forensics image.


Now We can investigate and We can Verify  Evidence Integrity and We Can show in Court.




We got  Different hash Value when we Edit  DVD in FTK 




Some Imager have Error , We can Edit  Evidence DVD, But hash value are Same 





Comments

Popular posts from this blog

A Case Study on Geoprofiling and Imagery Analysis