CRU Ditto Forensic FieldStation - Manual (Page 10)

10
Protecting Your Digital Assets TM
Ditto Forensic FieldStation User Manual
c. Select the destination disk for the clone from the “Clone Destination” drop-down box and the destina-
tion disk for the image from the “Image Destination” drop-down box. Destination disks do not have to
be the same physical media as the source disk, but each must be larger than the source disk.
d. Select the destination disk partition on which to save the image file from the “Image Partition” drop-
down box.
e. Select which type of physical image you would like to create from the “Physical Image Type” drop-
down box. The image types available are E01 or DD . (You can modify which image type appears by
default in the drop-down box on the “Configure” screen’s “System” tab. See Section 5.1.)
f. Click the Start button . A “Completed” message box will pop up when the action has finished. Click
on the message to continue.
You can view the results of the clone and image action by scrolling down to the “System Log” panel on
the “Home” screen. Find and click on the latest links, which will be denoted by a filename with a date/
timestamp format: “S_yyyymmddhhmmss”. Alternatively, you can click on the
Logs button from the top
menu bar.
4.1.5 Erase Destination Disk
The Ditto Forensic FieldStation erases the destination disk using your preferred Erase Mode. The Erase
Modes available are Clear Partition Table, Quick Erase, Custom Erase, Secure Erase Normal, Secure Erase
Enhanced, DOD Clear, DOD Sanitize, NIST800-88 Clear, and NIST800-88 Purge.
To erase a disk, follow these steps:
a. Select Erase Destination Disk from the “Action to Perform” drop-down box.
b. Select the Erase Mode to use from the “Erase Mode” drop-down box. (You can modify which erase
mode appears by default in the drop-down box on the “Configure” screen’s “System” tab. See Sec-
tion 5.1.)
c. Select the target destination disk from the “Target” drop-down box.
d. Click the Start button . A “Completed” message box will pop up when the action has finished. Click
on the message to continue.
You can view the results of the erasure action by scrolling down to the “System Log” panel on the
“Home” screen. Find and click on the latest link, which will be denoted by a filename with a date/time-
stamp format: “S_yyyymmddhhmmss”. Alternatively, you can click on the
Logs button from the top
menu bar.
Figure 7. The “Action” section on the “Home” screen, showing
the options available for the “Erase Destination Disk” action.