Why do the hash values of the original image and the resulting new image remain the same when using FTK Imager?

When using FTK Imager, the hash values of the original image and the newly created image remain the same because the software hashes only the data during conversion. This means that FTK Imager carefully preserves the integrity of the data as it processes and creates the image. Hash values, which are essentially digital fingerprints of data, are calculated based on the actual content of the file or disk.

Since FTK Imager performs a bit-by-bit copy of the source, it ensures that the entirety of the original data remains unaltered and identical in the new image. Only the raw data is hashed, and because this process does not modify or change the underlying data, the hash values will match between the original and the new images.

This concept is crucial in digital forensics, as maintaining data integrity is essential for the accuracy and reliability of investigative results. If the data were modified in any way during the imaging process, it would be reflected in differing hash values, indicating a potential issue with the evidence.