1. Can someone double-check and confirm the file hashes listed at http://computer-forensics.sans.org/challenges/#evidence are correct for evidence06.zip

    I’ve downloaded it several times, with different browsers, and keep getting this hash:
    MD5: 2745E619E845BDEF6012FA42C1F6AA6E

    Instead of the expected hash:
    MD5: efac05c50c0ae92bf0818e98763920bd

  2. sherri

    May 29, 2010 at 10:51 am

    f4s: That’s the MD5sum for the pcap inside the zip file (evidence06.pcap), not the zip file itself. Try unzipping it and check the hash of the pcap file.

Leave a Reply

Your email address will not be published.