Hash Mismatch After Imaging a Failing Drive

The two hashes cover different byte streams, so a mismatch is expected on a failing drive.

• Source hash (A4F1...) is computed over what the imager could actually read. With pending and reallocated sectors, some LBAs return errors; ddrescue either skips them or substitutes a fill value in the output stream. The tool's "source" hash may cover only successfully read data, or a stream where errors were handled by a different fill policy than the output.
• E01 payload hash (9C02...) is computed over the complete logical image, including any zero or pattern fill for unreadable sectors. Because that stream contains bytes that never came from the platter, it cannot equal a hash of only readable source data.
• Internal consistency is proven: the verification pass reproduces 9C02... from the E01. That proves the image file has not changed since acquisition; it does not prove bit-for-bit fidelity to the entire original.

This does not invalidate the acquisition. Forensic soundness depends on a documented, reproducible process and disclosure of the gap, not on a match that is physically unattainable. The correct evidence of fidelity is the ddrescue mapfile/log, the exact unreadable LBA ranges, the fill policy, and the per-pass logs. Verify one subtlety: confirm that the source hash was computed with the same fill semantics as the output; if not, even a perfect read would mismatch. You can demonstrate equivalence by hashing a second source read with the identical fill or by showing the mapfile accounts for every differing block. State plainly in the report that the image contains N unreadable sectors and that those ranges cannot support any conclusion, positive or negative.

Build a record that lets an independent examiner reproduce and audit every decision.

Device and acquisition: drive make/model/serial/firmware, photographs of labels and connections, write-blocker make/model/serial/firmware, host system, interface, tool name/version, exact ddrescue command line, number of passes, retry settings, and the retained mapfile and per-pass logs.

Hash semantics: record the algorithm, what each hash was computed over, the fill value used for unreadable sectors, and the precise LBA/byte ranges of every unreadable block with counts. Do not simply write "hash mismatch"; explain the mechanism.

Quality control: preserve the verification log; consider a second acquisition attempt limited to failed sectors (ddrescue retry) and document each attempt; run a second tool (for example a hardware imager or Guymager) against the E01 to confirm it parses and to corroborate the payload hash. Photograph and note drive behavior, power cycles, and any clicks. Keep the original drive sealed and stored appropriately.

Chain of custody and disclosure: receipt records, sealed bag numbers, examiner and witness identities, time zone, and a written statement of limitations. Disclose the unreadable ranges to the prosecutor and opposing counsel before the hearing. If any relevant file's clusters fall inside an unreadable range, say so explicitly rather than implying the file was absent. The goal is not to hide the defect but to show that you measured it, bounded it, and did not overstate the image.

A clean hash equal to the source cannot be obtained while sectors are unreadable, and chasing one creates risk without adding integrity.

• The source has no single stable hash on a degrading drive; repeated reads can return different results and can generate additional bad sectors. Re-imaging may produce a different source hash and more damage.
• The existing E01 is internally verified. Its evidential value depends on the documented mapfile, not on matching an impossible number.

Decision framework:

1. Determine whether the unreadable LBA ranges intersect files relevant to the case. Parse the file system from the image and check the cluster runs of key files against the mapfile.
2. If they do not intersect, proceed with analysis and disclose the limitation.
3. If they do, consider a targeted retry of only the failed sectors, or a specialist recovery service, and weigh the nine-day hearing deadline. Do not repeatedly spin a clicking drive.
4. If a second image is made, preserve both images and all logs, and state which is authoritative and why.

Never describe the image as a bit-for-bit copy of the entire drive. Describe it as a documented best-effort image with a known number of unreadable sectors. That phrasing is accurate, defensible, and far stronger under cross-examination than an unsupported claim of completeness.