Closed brunodgarcia closed 2 months ago
@brunodgarcia where did you change the bytes? EWF is a container format there might be other reasons for the verification to fail
@brunodgarcia where did you change the bytes? EWF is a container format there might be other reasons for the verification to fail
I just changed a few random bytes in file and now I understand I probably didn't corrupt the volume data as expected. FTK indicates the file no longert contains a valid evidence.
The hash values worked as expected when I changed bytes right in the middle of the file.
I made the incorrect assumption that failure simply meant a mismatch in the hashes.
I apologize for raising the issue, and I appreciate your attention to this matter. Thanks!
What is known about the format is documented here https://github.com/libyal/libewf/blob/main/documentation/Expert%20Witness%20Compression%20Format%20(EWF).asciidoc it contains various checksums and edge cases.
closing this issue given the question appears to have been answered
I have changed a few bytes of an E01 file in order to test ewfverify. The change was correctly detected, but the program shows the same md5 hash for stored and calculated fields.
The project was built on Windows using Cygwin64.