What part of creating an md5sum under Knoppix of an ntfs drive directory writes to the ntfs drive?
I thought the process is carried out in ram and stored results in knoppix file system.

I haven't yet created an md5sum with knoppix. I have done so with hash tabs. Unfortunately its stored list isn't compatable with linux.

I was told that the only way to verify 100% of being clean from malware is offline file comparison, Knoppix is one of the suggested methods along with BartPE, WinPE and ERD Commander. Furthermore, virus scanners are only valid with signatures in their data base. So it would not catch a new or altered infection.
I was advised not to create the BartPE or WinPE on an infected system. So this is the dilemma, I only have 1 computer.

This is why I thought Knoppix and md5summing would be a better option, allowing me to do file integrity checks.

Are there other ways to do file comparisons using Knoppix to check the ntfs volume?
[/url]