Mar 122011

I have a old 512MB US-PEN (unknown manufacturer). Every time i check the HASH it change in two different values for a short time  (40 sec). After it, i got always the same value. The controller is unknown.

I calculate the HASH with md5sum (HELIX v1.9).

This is the technical details of the USB-PEN:


Total capacity: 500.301.824 bytes = 477 MB

Bytes per sector: 512
Sector count: 977.152
Windows disk signature: 0027AXXX
Unpartitionable space: 0 Sectors
Partitioning style: MBR

Partition 1
Sectors 32 – 977.151
Partition table: Sector 0
File system: FAT16
Total capacity: 500.285.440 bytes = 477 MB
Sector count: 977.120
Usable sectors: 976.608
First data sector: 512
Bytes per sector: 512
Bytes per cluster: 8.192
Total clusters: 61.038

With ADEPTO V1.0 on HELIX v1.9 i have acquire two image with the two different hash (the last, don’t change after a short time):

IF you compare the two evidences:


Search for differences

1. [ XXXusb10_5.dd.000]: 500.301.824 bytes
2. [
XXXusb10_4.dd.000]: 500.301.824 bytes
Offsets: hexadec.

14DFF27c:   FF 7F

1 difference(s) found.


so, let’s go to see:

The sector is: 684024


  3 Responses to “512MB USB-PEN: two different hash at every check”

  1. Ciao Litiano,
    non so se ti sei già dato una risposta ma una plausibile potrebbe essere questa (premettendo che non sono esperto di elettronica, ma provo a spiegarmelo così):

    in binario 7 è 0111, F è 1111.

    E’ possibile che lo stato di magnetizzazione di quel bit fosse piuttosto border-line e quindi talvolta veniva letto come 0 e altre volte come 1.

    Cosa ne pensi?

  2. Ciao Michele,

    è una ipotesi plausibile. Ho svolto ulteriori TEST del tipo tenendo il dispositivo in “frigo” per alcuni giorni e poi effettuando subito il TEST. Sempre il medesimo risultato. Direi che alla fine la cosa più importate è sapere che problematiche di questo tipo possono succedere. Peccato che non ho individuato il tipo di controller.


  3. I ran across this page randomly and I thought I could help you out…

    Hashes on flash media are NEVER reliable and you should rely on your original image hash instead (as long as the hash of your original image of the device does not change you should be fine in any case). The reason the hashes will differ almost definitely every time you hash the device is because of what is known as wear leveling. It is a science built into all flash media today and it allows flash memory to “wear” at an even level so it lasts a longer time. It is handled by the flash memory controller and basically attempts to write data to different segments on the flash drive all the time.. (instead of just overwriting in first few “sectors” when you remove or add files). This allows flash drives to last much long and not burn out as fast as they would without it. More information on wear leveling can be found here: . I hope the my enlglish is understandable enough for you, I applogize if it is not. Feel free to contact me if you’re confused!


 Leave a Reply



You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>