Some source evidence drives and their images can be involved in a long-running investigation case and wait to be presented in court for months or years on end. Data stored on such drives and their image files may eventually get corrupt. Therefore it may be critical for an investigator to ensure the integrity of data on such devices or image files before resuming to work with them or presenting them in court.
Over the years, E01 file format has become a popular format for forensic purposes due to its ability to store not both the image of the drive, but also case and evidence details. E01 file can also contain both MD5 and SHA-1 hash values.
To view the previously calculated hash calculated for an E01 file with Atola TaskForce, open the imaging report in the case management system. It contains the hash values calculated during imaging.
Alternatively, you can look up the metadata stored in the E01 file itself:
- Open Devices menu by clicking the Devices button in the top bar;
- Click Select file box in the File category;
- Select the E01 file in the file browser.
Hash calculated during imaging stored in E01 file’s metadata
To ensure the integrity of the data in the file, you can recalculate its hash.
- Click Hash in the left-side task menu. This will open the devices to choose the one for which you want to calculate hash.
- Click Select file box in the File category.
- Select the E01 file in the file browser.
- Make sure to select the same hashing types (MD5, SHA1, etc.)
- Click Start button
Start hash calculation
Adjust hashing settings and start hash calculation by clicking the Start button.
When the hash calculation is completed, you can make sure that the two sets of hashes are identical.
Compare the calculated hash values to the ones calculated during imaging
Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users. Yulia regularly represents Atola at DFIR events, holds free workshops and webinars about Atola imagers functionality and advocates on the users' behalf to ensure that Atola keeps on adding value and raising the bar for the industry.
- Top digital forensic conferences in 2024 - January 1, 2024
- 2023. Year in Review - December 31, 2023
- Top digital forensics conferences in 2023 - January 1, 2023
Yulia Samoteykina
Director of Marketing Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users. Yulia regularly represents Atola at DFIR events, holds free workshops and webinars about Atola imagers functionality and advocates on the users' behalf to ensure that Atola keeps on adding value and raising the bar for the industry.
