How to check the MD5 (or SHA1) hash checksum of an entire volume, disk or image
To check the MD5 (or CRC32, SHA1 or SHA256) hash checksum of an entire volume, disk or image, follow the procedure below:
- Navigate to "Manage Case" from the sidebar or Start page in OSForensics
-
Click "Add Device" to add the desired image, volume or disk to the case. When adding an image file with a partition table, you may be prompted with the following:
- To check the hash of the entire image including the partition table and all partitions, select "Use entire image file". Otherwise, select the desired partition.
- Navigate to "Verify/Create Hash" from the sidebar or Start page in OSForensics
- Select "Volume" and the disk/volume that was added in Step 2 from the dropdown list
- Select the hash function and click the Calculate button
-
Once the hash has been calculated, copy/paste the expected hash value into the comparison hash field. If the hash matches, a green checkmark appears. Otherwise, a red cross is displayed.
