4 ms·
Given an input image of a hard disk or other storage medium, validate that the hash when given to you and after your analysis are the same.
by WrtCdEvrydy 6y ago
Given an input image of a hard disk or other storage medium, validate that the hash when given to you and after your analysis are the same.
- bawolff 6y agoIn the presence of someone malicious swapping out drives for a malicious end? Or as a guard against accidentally swapping out the wrong hard drive due to an accident? For the former, md5 isnt secure (although its not really an attack you can pull off after the fact). For the latter, i guess so, but it'd be hilarious if whatever attacker is causing you to do forensics made all the hard drives have the same hash to make your life more complicated.
- WrtCdEvrydy 6y agoForensics work mostly comprises of people doing criminal or civil things. Network intrusions, someone sending a fucked up email at work would require you to retrieve data whether it be some logs, or a full hard disk copy. The idea is that I do analysis and can prove that what I started with (hash1) is the same as when I ended (hash2). If the hash changed, either there was a hardware failure (on write blockers) or a mistake was made when analysing the dataa.