Before you begin your media examination, create a hash of the copy you made of the original media. Does it agree with the hash of the original? If so, you may proceed. If not, find out why. Perhaps you mounted the copy and allowed some writes to occur. Or perhaps the copy process was flawed. In any case, don’t start the analysis until you have a clean copy (an exact copy of the original media, with the same hash).
Checksum or hash sum is a method to detect errors in transmission or storage of data to determine if data has been altered. A checksum or hash performs a mathematical calculation on the data involved before it is sent to calculate a unique value conditioned by the content of the data itself. This calculation ...