Atola TaskForce supports hash calculation of both the evidence drive and the image in conjunction with imaging. We have developed highly flexible functionality to help optimize evidence acquisition process to fit one’s internal procedures while avoiding further damage to fragile media.

To calculate hash of both the evidence and the image:

  1. Click Image category of the left-side menu
  2. Select the Source device and the Target device or file
  3. Click Change button in the Settings summary page
  4. In the Hashes tab there are three checkboxes:
  • Pre-hash source device
  • Hash source during imaging
  • Post-hash target device
Selecting hash methods to calculate hash during forensic imaging of a hard drive

Select hash methods

 

Multiselect is available, which allows a user to use all three of these options.

However, Pre-hash source drive option must be used with caution: although pre-hashing can be required by an investigator’s internal procedures,
when dealing with drives that have been diagnosed with hardware failure, this operation may cause further damage to the drive before essential data is imaged.

On the contrary, Hash source during imaging is the most appropriate way to calculate the hash of a fragile source evidence drive.
In this case, TaskForce only needs to read the data on the drive once to image and calculate hash simultaneously, thus minimally using the drive’s hardware.

NB Linear hash can only be calculated by reading data in sectors consecutively in one pass. When it encounters a bad sector, linear hash calculation is discontinued. Thus it shows resulting hash values up to the first bad sector.
In upcoming releases, we will support Segmented hashing so that hash can be calculated for damaged drives.

Post-hash target device option allows to properly record the calculated hash in the case.

Imaging results with hash values for both hash during forensic imaging and post-hash

Imaging results with hash values for both hash during imaging and post-hash