Hash mismatch

I did a logical disk acquisition on a USB stick using DD and calculated the SHA-1 and MD-5 hash using Windows' builtin certutil tool. I then had FTK Imager calculate/verify the hash of the image generated by DD and they matched, as expected. On an experiment, I did a logical disk capture of the physical USB stick through FTK, generated an image in the .E01 format then compared the calculated hash values between FTK's builtin hash calculation tool and Windows' …

computerforensics hash