PDA

View Full Version : File Verification - Hashing



Rick L.
December 8th, 2005, 07:46 PM
I came upon Downloader Pro yesterday and after testing the trial version, found that it may fit into our forensic imaging workflow. My question is how to integrate a hash routine into the download process (MD5 or SHA-1 for example). I need to be able to authenticate that the images downloaded from the card are true & accurate copies of those on the card.

Right now, I've set the program MD5Summer to run as a function of the Custom button and have automation turned on. This works, but requires user intervention to complete the hash routine. The help files in Downloader Pro provide an assurance that before deleting the files from the CF card, the files are verified - does this mean that Downloader Pro is running it's own hash? If so, is there a way to expose this & write the values to a file in the download directory? If not, can anyone propose a way to complete the hash routine in another way (without user intervention)?

I've got to say that you've come up with a great tool!

Chris Breeze
December 11th, 2005, 10:46 AM
Downloader Pro checks the filename, size and date to verify that the file has been correctly downloaded. A full checksum to compare source and destination would be more rigorous, but can't be used when downloading directly from a camera or if the image has been modified e.g. rotated, the dpi adjusted, IPTC data added and a color profile embedded. This hasn't been a problem in the almost three years since DLPro was first released. Usually if there is going to be a problem an error message will be displayed when DLPro attempts to copy the file.

A forensic officer has written a plug-in for DLPro which computes two different, secure checksums and adds them to a text file with the downloaded image. I think he plans to make this freely available but I don't want to give his details on a public forum at this stage. I will send you his email address in a separate email.

Edan
December 28th, 2005, 07:14 AM
Hi Rick,

I'm very interested in the hashing process you talked about.
I don't need the formal documentation of it, but I do want to make sure that I can be sure that all of my pics are good before the software automatically delete them from the memory card.

This way, when the time is short, I can quickly "empty" several cards to my laptop and move on, with no need to check that the pictures came out ok.

I would appreciate it if you could post here your final solution to this, should you find a suitable one.

Thanks
Edan