E01 file format is the de facto standard format for forensic examiners to store images due to its ability to store not only a copy of the evidence drive, but also case and evidence details. E01 file can also store both MD5 and SHA1 hash values calculated during imaging.

To image a source evidence drive to an E01 file, you have to create a new target file.

Creating a new E01 file

  1. Click Image in the left-side menu
  2. Select the source evidence drive in Select source device panel
  3. Click Select File in Select target devices panel
  4. In the file selector, find the folder to store the image and click the plus (+) button in the bottom right corner
  5. In the pop-window, select E01 file type and click Create button
  6. Fill in E01 file information and click Create button.
  7. Click Continue button
Create an E01 file

Enable dual-hash and start imaging

  1. Once you have selected the source drive and created the target file, you end up in Settings summary page. Click Change button to adjust the imaging settings.
  2. In the Hashes tab make sure that Hash source during imaging is selected, also select both MD5 and SHA1 hash types.
  3. Click Start button to proceed with imaging.
Adjust imaging settings

The report and the E01 file

The report

Upon completion of imaging, you can see both MD5 and SHA1 hash values indicated in the Imaging completed report.

E01 file with calculated MD5 and SHA1 hashes

It is also possible to look up the information of the created E01 file. To do that, perform the following actions:

  1. Open the Devices menu by clicking the Devices button in the upper right corner.
  2. In the File section, you can see the recently created files.
  3. Click the corresponding E01 file to view its metadata.

The MD5 and SHA hash values will be there.