Fedora live USB data was changed after installation

Ask Fedora
1

Hello,
I usually install fedora using live DVD but this time I needed to use live USB.
I downloaded fedora 43 iso, verified file checksum, then I wrote iso to the flash drive using dd.
After that I used dd to create iso file from the flash drive and verified the checksum again, all were correct.
Than I installed fedora on my laptop.
Installation was successful.
After that I decided to check the flash drive content again and used dd to create iso from flash drive.
This time the checksum was different.
Is was
d0b37619f2c3cce78fd12f9b72d649f1386b59f99e95026ebd40399d5342235d
when it supposed to be 2a4a16c009244eb5ab2198700eb04103793b62407e8596f30a3e0cc8ac294d77

Is that the correct behavior or my installation was corrupted by virus of some sort?

Live DVD has no such problem of course (that why I use it) but this laptop does not have a DVD drive.
Is there any way to write protect the flash drive?

2

It sounds like it could well be this behaviour, where the GPT backup table gets relocated, changing the checksum of the image.

If so then it’s awkward for the purposes of integrity checking, but it’s not malware or anything intrinsically harmful.

3

How did you limit the number of bytes to copy from the USB device? If you didn’t, the resulting iso files may be way bigger than the original iso file, and thus the checksum would be meaningless.

You can use the checkisomd5 on the iso file that was copied from the USB device, because checkisomd5 knows how many bytes to check. You can also run checkisomd5 on the USB device.

4

If you want to recreate this issue here are the steps for Fedora-Workstation-Live-43-1.6.x86_64.iso

  1. Clean your flash drive from all partitions and rewrite content with zeros through disks utility
  2. Run sudo dd if=Fedora-Workstation-Live-43-1.6.x86_64.iso of=/dev/sdc bs=8192 (your flash drive path might be different, check in disks utility)
  3. Run sudo dd if=/dev/sdc bs=512 of=output.iso
  4. Run dd if=output.iso bs=512 count=5355840 of=output_2.iso (the count number is Fedora-Workstation-Live-43-1.6.x86_64.iso file byte size divided by 512)
  5. Run dd if=output.iso bs=512 skip=5355840 of=output_3.iso
  6. Run sha256sum Fedora-Workstation-Live-43-1.6.x86_64.iso
  7. Run sha256sum output_2.iso
  8. Compare outputs they should be the same
  9. Run od -t x1 output_3.iso (to check that all other bytes on the flash drive are zeros)
  10. Insert flash drive into your pc and boot from it
  11. Once fedora live USB loaded just turn off the pc
  12. Disconnect the flash drive
  13. Boot into your usual os and reconnect the flash drive
  14. Run sudo dd if=/dev/sdc bs=512 of=output_changed.iso
  15. Run dd if=output_changed.iso bs=512 count=5355840 of=output_changed_2.iso
  16. Run sha256sum Fedora-Workstation-Live-43-1.6.x86_64.iso
  17. Run sha256sum output_changed_2.iso
  18. Outputs will differ
  19. Run dd if=output_changed.iso bs=512 skip=5355840 of=output_changed_3.iso
  20. Run od -t x1 output_changed_3.iso
  21. Output is zeros, no extra data was written to the flash drive

I agree that maybe it is not the most perfect way to check it but I am not command line guru.

I checked Fedora-Workstation-Live-42-1.1.x86_64.iso and no data was changed.
Hope they will fix it in fedora 44, because this behavior is unsettling.
I thought that my installation was corrupted and spend some time trying to figure it out.

P.S.
Windows OS was not involved in this situation.