Hello,
Thanks for the reply, It's the content I want to know.
Basically, I have an SD card which has an OS on. Booted up into it and turned it off, then acquired it using Encase. I then booted it up again and turned it off, and acquired it again. The hash values are different.
I expected something to change but now I want to know what has changed between them both. So can I do a comparison to see if something is the same ignore it, and the differences show.
Just need to know what's changed and where it's located.
↧