So you have a Source evidence drive and its image on a different device, and you have a record that their hash values were identical in the past.
Atola Insight Forensic: Imaging Results
If you get a different hash value when you calculate the hash of the target now, it could be due to hardware failure, or because the device containing your image was used by a third party.
Atola Insight Forensic: Calculated Hash
To understand how substantial these changes are, you will want to locate the sectors that have been modified.
- In the Disk Utilities category click Compare subcategory.
- Make sure that the whole range of sectors of the drive and radio button next to Device on DiskSense Target Port option is selected
- Click Compare button.
Atola Insight Forensic’s high-performance compare function will compare the source and the target and will help you identify and locate the modified sectors:
Atola Insight Forensic compares source and target to help the operator identify and locate modified sectors
Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is all about explaining its capabilities to the users.
- XFS, RAID 10 and new imaging features. TaskForce 2021.8 is here! - September 8, 2021
- Imaging and hot plug of NVMe drives with DiskSense 2 - August 19, 2021
- The Story of Atola Insight hardware - July 13, 2021
Yulia Samoteykina
Director of Marketing Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is all about explaining its capabilities to the users.
