Hashing is Important in Digital Forensics

FTK imager will not output hash value and verify hash value  for DVD & CD
So, ....
First -  Verify Hash for Original DVD and Take Screen Shoot ,I Check Again and Again
for surely hash Values ..

Second  -  make DVD disk image and FTK will output isoBuster CUE Format , Next  I Verify Image file for Hash Value , Now Original DVD hash Value and Image Hash Value.So, We got 2 hash Value.  One for Original DVD hash value ,Next Hash Value for forensics image.

Now We can investigate and We can Verify  Evidence Integrity and We Can show in Court.

We got  Different hash Value when we Edit  DVD in FTK 

Some Imager have Error , We can Edit  Evidence DVD, But hash value are Same 


Popular posts from this blog

B-Trees (NTFS)

NTFS Index Attributes

အြန္​လုိင္​း​ေပၚက လိမ္​လည္​မႈမ်ား (အပုိင္​း ၂ )