MD5 or SHA HASH a Mounted Image

To verify mounted drive has an identical MD5 HASH to an acquired image file, follow these steps:

1. First it is necessary to mount the image file as physical drive:

• Run Mount Image Pro Version 4;

• Select the FILE / MOUNT in the top menu of the main program screen, or click the button. Note that it is not possible to mount all image types using the "Mount Disk" option (if a logical image file .ad1, .l01 or a physical drive is selected, Mount Disk button will be greyed out);

• In the device selection window, click to add and select the required image file;

• Once the required image is selected, press the button to display the following screen:
  
  
  

• Mount as "Physical and Physical as drive letter"

The Mount as "Physical and Physical as drive letter" first mounts the physical drive, and then mounts the physical drive a second time and allocates it a drive letter.

2. Now run EnCase®, FTK® or another program capable of performing the MD5 or other type of checksum. Select the mounted physical drive and calculate the checksum. Compare this to the original acquisition hash. They should be identical.