Atola Technology

Comparing hashes of source and target to find modified data

So you have a Source evidence drive and its image on a different device, and you have a record that their hash values were identical in the past. If you get a different hash value when you calculate the hash of the target now, it could be due to hardware failure, or because the device […]

Case Management: Print reports from a case

Insight’s Case Management system includes flexible printing functionality. To print a report click the Print link in the case’s Home page. In the Print Case History window you get all the reports listed, sortable by date or by reported operation. It is possible to tick just some of the reports or select all reports in […]

Calculating MD5 and SHA1 hashes of an existing E01 file

It is not uncommon that source evidence drives and their images may be involved in a long-running investigation case or wait to be presented in court for months or even years. Data stored on hard drives or image files may get corrupt over time. That is why an investigator may need to ensure the integrity […]

Creating a logical image of a source drive

While physical imaging involves sector-for-sector copying the whole evidence drive from the first LBA to the last one, logical acquisition implies bit-for-bit copying of the file structure. Logical acquisition is handy, when time is limited and you need to quickly start working with the file structure. At the same time, logical image does not include […]

Case Management: Finding and Opening a Case

Insight’s Case Management system records every step of data acquisition process saving them into reports grouped by cases. To view the whole list of cases and their devices: Go to Case category in the top menu Click on Search/Open option In the Search and Open Case window you will see the list of all the […]