Atola Insight Forensic
Comparing Hashes of Source and Target to Find Modified Data
So you have a Source evidence drive and its image on a different device, and you have a record that their hash values were identical in the past.
If you get a different hash value when you calculate the hash of the target now, it could be due to hardware failure, or because the device containing your image was used by a third party.
To understand how substantial these changes are, you will want to locate the sectors that have been modified.
Atola Insight Forensic's high-performance compare function will compare the source and the target and will help you identify and locate the modified sectors: