Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20109

Mobile Phone Forensics: Change in Hash values

$
0
0
The first thing I would do would be a binary compare of the two files. From DOS c:\fc /b <file1> <file2> You can see the size of the difference. If it is just a few bytes you might determine if it is a date change. ie Look at the location that is different with a Hex viewer Are the files the same length? A different hash value just indicates that the files are not (100%) indentical

Viewing all articles
Browse latest Browse all 20109

Trending Articles