First, using FTK Imager Lite, "add" the evidence file you want to recover the acquisition hash from.
Once the evidence file has been added to FTK Imager Lite, right click on the top level evidence file name in the "Evidence Tree" window.
Then left click on "Verify Drive/Image...." and FTK Imager will give you the MD5 & SHA1 hash values:
Computed hash:
Stored verification hash:
Report hash:
Verify result: (MATCH) hopefully
↧