Follow

How to Verify the MD5 Hash Value of an Image

Created by: Brendan Bone
Created date:
Last Updated date:

1) Launch FTK Imager

2) Select File > Add Evidence Item

3) Select "Image File" and proceed to add the image

4) Under the "Evidence Tree", right-click your image and select Verify Drive/Image

5) Compare the hash value calculated to the known hash value

6) Optional: To output the image verification hashes to a text file, follow the steps below.

6a) Create a text file in the same location as the image.

The text file's filename prefix should match the name of the first segment of the image, and the text file's extension should be "txt."

E.g. if the first image segment is named "mantooth.e01", then the text file should be named:

mantooth.e01.txt

6b) Repeat step 4 above.

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request

Comments

  • Avatar
    Michael Gruben-Trejo

    Is there any way to queue multiple images to verify?
    We routinely get ~30 different image sets at a time, and it is unpleasant manually queueing the next one once the previous one finishes.

Powered by Zendesk