When the target drive is larger than the source evidence drive, the target hash will not be identical to the hash of the source. To avoid this, you can limit the drive space by enabling HPA to a SATA target.
Create a new E01 file, to which you will image your evidence and select both MD5 and SHA1 hashes to be calculated in the course of imaging.
SMART table is a valuable source of information about a hard drive’s health. SMART (Self-Monitoring, Analysis and Reporting Technology) provides stats of a drive’s operation, thus helping predict its future failure.
If you need to create multiple images of a drive for different purposes, with Insight you can image to three targets simultaneously.
Every once in a while forensic examiners come across hard drives that get shorted. In most cases, a drive has become shorted after experiencing overvoltage either due to a power supply failure or as a result of a user error. Here is what happens to drive in these scenarios and how to fix this.