3

On Linux I dd a binary image to a micro SD card and check each the source and target md5sum, they are identical. I then safely remove the card, and remount the card and do an md5sum again. It is different.

Why?

Thank you, Bertrand

quadmore
  • 39
  • 1

1 Answers1

8

Each time you mount, and/or open a directory, metadata changes. Data like "number of mounts", maybe even access times, etc. are written to the filesystem, which in turn, changes the md5sum of the card.

If you do an md5 only on files residing on the card, they should stay the same.

mulaz
  • 10,682
  • 1
  • 31
  • 37
  • 2
    Correct, and this is one of the reasons people in forensics always use "write blockers" when accessing storage. – Dan Feb 27 '13 at 18:10
  • 1
    Another approach would be to generate a list of md5sums, and then generate a md5sum for the list of md5sums. It's a useful trick. `find /path -type f -exec md5sum {} \; | LC_COLLATE=C sort | md5sum` The sort is probably unnecessary but it ensures consistent output. – Andrew B Feb 27 '13 at 18:51