So you have a Source evidence drive and its image on a different device, and you have a record that their hash values were identical in the past.
Atola Insight Forensic: Imaging Results
If you get a different hash value when you calculate the hash of the target now, it could be due to hardware failure, or because the device containing your image was used by a third party.
Atola Insight Forensic: Calculated Hash
To understand how substantial these changes are, you will want to locate the sectors that have been modified.
- In the Disk Utilities category click Compare subcategory.
- Make sure that the whole range of sectors of the drive and radio button next to Device on DiskSense Target Port option is selected
- Click Compare button.
Atola Insight Forensic’s high-performance compare function will compare the source and the target and will help you identify and locate the modified sectors:
Atola Insight Forensic compares source and target to help the operator identify and locate modified sectors
Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users and advocating on the users' behalf to ensure Atola keeps on adding value and raising the bar for the industry.
- Q&A team about Atola imagers at GPEC and Forensics Europe Expo - June 30, 2022
- Video: TaskForce 2022.4 new functionality walkthrough - April 20, 2022
- When TaskForce’s integration into your automation solution is a game changer - March 16, 2022
Yulia Samoteykina
Director of Marketing Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users and advocating on the users' behalf to ensure Atola keeps on adding value and raising the bar for the industry.
