Ex01 Verify hash Failure #212
Description
Create Image
ewfacquire.exe -t case123_image -w -r 3 -g 128 -d sha1 -f encase7-v2 -C 123456 -M physical -e "John Doe" -E 001 -D "Disk evidence for case 123" -N "Acquired on 2023-12-12" -c deflate:best -r 3 -j 4 \.\PhysicalDrive1
Evidence segment file size in bytes (1.0 MiB <= value <= 7.9 EiB) [1.4 GiB]: 19 GiB
Default settings for remaining options
Which part of ewfVerify should I check?
ewfVerify.exe case123_image.Ex01
Ex01 file created with encase7-v2 option
ewfVerify results
MD5 hash stored in file: 72ef9b239d37c690bbbb2523883c55d8
MD5 hash calculated over data: 25543448a355affa5473d513176f6bd6
SHA1 hash stored in file: 1d50e793a1a3d9d4eff665666390482508d86a43
SHA1 hash calculated over data: b0009ba971971f8ff63ea7390004e4f038abf462
ewfVerify.exe case123_image.E01
E01 file generated by encase6 option
ewfVerify results
MD5 hash stored in file: 72ef9b239d37c690bbbb2523883c55d8
MD5 hash calculated over data: 72ef9b239d37c690bbbb2523883c55d8
SHA1 hash stored in file: 1d50e793a1a3d9d4eff665666390482508d86a43
SHA1 hash calculated over data: 1d50e793a1a3d9d4eff665666390482508d86a43