When you work with a damaged device, and imaging can only be performed in multiple passes due to bad sectors or physically damaged areas or heads, it is impossible to calculate linear hash of the drive. This can become a serious challenge if you need to prove evidence integrity in the court of law. And it is for such cases that Atola Insight Forensic has Segmented hashing functionality.
According to the recommended workflow, run Automatic checkup of the evidence drive.
Atola Insight Forensic: Automatic checkup of the evidence drive
If the drive has hardware or bad sector issues, it is likely that imaging will not be completed within one pass, and you can calculate the hash for such drive only with Segmented hashing.
Furthermore, we recommend that you calculate hash and image the drive simultaneously: this way data on the drive is only read once for both processes and you avoid further deterioration of the drive:
- Press on Create new session link in Imaging category of the left-side menu and select the target drive
- Click on Show settings link in Preset line
- Tick the box next to Hash source during imaging
- Select Segmented option in Hash method drop-down menu
- Click Start imaging button
Atola Insight Forensic: Segmented hashing option
Please note that Segmented hashing option disables imaging in reverse direction on all passes.
Just as imaging narrows down the problematic areas and reads the data within these areas on each subsequent pass, Segmented hash is calculated for the successfully read spans of data.
Atola Insight Forensic: Damaged drive imaging
Once imaging is completed, you can find the set of hashes calculated in the course of imaging. Go to the imaging report
Atola Insight Forensic: Imaging results
In the excel file with segmented hashes you can find the hash calculated for all the 4 GB segments of the drive space, as configured in the settings. Some of the segments are smaller due to an encountered bad sector, which, in accordance with the multi-pass imaging algorithm forced Insight to jump by a preconfigured number of sectors. Lower in the table you can find hash calculated for smaller segments within the jump area within the first three passes illustrating the concept:
Hash calculated for smaller segments within the jump area
This way segmented hashing allows obtaining a hash even for a severely damaged drive.
Please follow this link to learn how you can easily verify segmented hashes:
http://atola.com/products/insight/manual/Verify-Image-with-Segmented-Hashing.html
__
In November 2016 Atola Technology introduced a new hashing method called Segmented hashing.
Atola’s open-source tool Seghash, which was written in Go and has been released under MIT license, works on Windows, Linux and macOS. Atola Technology has published the tool on its Github page and encouraged the adoption of the segmented hashing algorithm by software vendors who want to provide their users with a superior hashing option.
Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users. Yulia regularly represents Atola at DFIR events, holds free workshops and webinars about Atola imagers functionality and advocates on the users' behalf to ensure that Atola keeps on adding value and raising the bar for the industry.
- Top digital forensic conferences in 2024 - January 1, 2024
- 2023. Year in Review - December 31, 2023
- Top digital forensics conferences in 2023 - January 1, 2023
Yulia Samoteykina
Director of Marketing Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users. Yulia regularly represents Atola at DFIR events, holds free workshops and webinars about Atola imagers functionality and advocates on the users' behalf to ensure that Atola keeps on adding value and raising the bar for the industry.
