Can I determine if a duplicated hard drive is an exact copy of the original?
Demonstrating that a forensically duplicated hard drive or other media device is precisely identical to the original is critical to ensuring the court admissibility of electronic information. To address this issue, a computer forensic specialist employs hardware and software to prevent the manipulation or corruption of data on the original device, while facilitating a true bit-by-bit duplication. To validate a successful forensic duplication and to verify the original is identical to the new copy, a hash value is calculated. This hash value is a sophistical mathematical algorithm known as MD5 (Message Digest 5) that computes a unique hexadecimal alphanumeric identifier based on the entirety of the data stored on a hard drive. This hash value is computed individually on the original hard drive and any subsequent duplications to confirm that they match, thus demonstrating an exact and identical copy.
