It is not uncommon that source evidence drives and their images may be involved in a long-running investigation case or wait to be presented in court for months or even years. Data stored on hard drives or image files may get corrupt over time. That is why an investigator may need to ensure the integrity of data on these devices or image files before resuming to work with them or presenting them in court.
Over the years, E01 file format has become a popular format for forensic purposes due to its ability to store not only the physical or logical copy of the source drive, but also case and evidence details. E01 file can also contain both MD5 and SHA-1 hashes. And it is considered a good practice among forensic specialists to calculate both hashes while imaging the evidence so that they are included in the E01 file.
To view the hash calculated for an E01 file with Atola Insight Forensic, open the file by pressing the Plus icon in the port bar and then selecting E01 image files (*.E01) file extension in the drop-down menu to view existing files with this extension.
In the Home page look through the File History and click on the Imaging target link.
This will open an Imaging target report, at the bottom of which you will be able to see both hashes calculated during the imaging session.
You may leave this window open or save the report as a pdf file to compare the hash with the newly calculated one later.
Then go to Calculate Hash page in Hashing category of the left-side menu and select Linear in Hash method drop-down menu and MD5 and SHA-1 in Hash type drop-down menu.
Once the hashes have been calculated, you can make sure that the two sets of hashes are identical.
- RAID 10 configuration autodetection and imaging - October 20, 2021
- XFS, RAID 10 and new imaging features. TaskForce 2021.8 is here! - September 8, 2021
- Imaging and hot plug of NVMe drives with DiskSense 2 - August 19, 2021