search

sleuthkit / autopsy

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.
http://www.sleuthkit.org/autopsy/
2.42k stars 596 forks source link

Error E01 Verifier #1178

Open fsanchezf opened 9 years ago

fsanchezf commented 9 years ago

Hi,

The data my system are: Product Version: Autopsy 3.1.2 (RELEASE) Sleuth Kit Version: 4.1.3 Netbeans RCP Build: 201306052037 Java: 1.8.0_25; Java HotSpot(TM) 64-Bit Server VM 25.25-b02 System: Windows 7 version 6.1 running on amd64; Cp1252; en_US (autopsy) I installed "autopsy-3.1.2-64bit.msi" CRC32: 8D9017B5 MD5: 702019CA69BFCB887EEF8C7EB64ADA56 SHA-1: 6042A70B8B8CCA26B017BA0A8D86A83D0649E87F

I add a imagen E01 and executed "E01 Verifier", the result is "not verified". With this result I probe with FTK Imager and EnCase Forensic Imager, but for both software the results are successful. Attached print screens.

snap4 snap5 snap6

Kind regards.

Felipe Sánchez F.

mfanton commented 9 years ago

I also notice the same behavior with any E01 image. The calculated hash does not match the stored hash and the result is always "not verified".