I used md5deep.exe to verify the two files on my image thumb drive.
Next I opened the cute.jpg file and cropped the picture and saved the file upon closing it. I verified the md5 of the file and it is different than the original.
For the file white.gif I rotated the picture 180 degrees. This just turned the picture upside down. I next re-ran the md5.
Something I found interesting is that I checked the original image file md5 and created a new image file and the md5 sums where the same
This is the outcome that I would have expected. However I deleted the file assignment1.002 simply because I wanted to name the file assignment2.001 and when I connected to the file with Windows Explorer and then copied the file over the md5 sums where different.
This is an important item to note. The OS will modify the files when you access them. So if you are gathering data you need to ensure that you use write blocker on the drive that you are investigating.
C:\MSDOS-Tools>dd if=\\.\L: of=\Assignment2.001
rawwrite dd for windows version 0.4beta4.
Written by John Newbigin
This program is covered by the GPL. See copying.txt for details
2880+0 records in
2880+0 records out
Finally I used dd to create a new image of the thumb drive with the altered pictures.