CRU Ditto Forensic FieldStation User Manual

Page 11

Protecting Your Digital Assets

Ditto Forensic FieldStation User Manual

Format After Erase

You can configure the Ditto Forensic FieldStation to automatically format a disk after you erase it.
Click on the

Configure tab

to go to the “Configure” screen. Then click on the

Erase tab

make sure

that “Format After Erase” is checked for each of the erase modes on which you’d like to enable this
setting.

4.1.6 Hash Disk

The Ditto Forensic FieldStation will hash any source or a destination disk using your preferred algorithm.
Hash values are saved in the System Log. The available algorithms are “MD5”, “SHA-1”, or “MD5 +
SHA-1”.

To hash a disk, follow these steps:

a. Select

Hash Disk

from the “Action to Perform” drop-down box.

b. Select your preferred hash algorithm from the “Hash Type” drop-down box. (You can modify which

hash algorithm appears by default in the drop-down box on the “Configure” screen’s “System” tab.
See Section 5.1.)

c. Select the target disk from the “Target” drop-down box.

d. Select the partition you want to hash from the “Partition” drop-down box.

e. Click the

Start button

. A “Completed” message box will pop up when the action has finished. Click

on the message to continue.

You can view the results of the hash action by scrolling down to the “System Log” panel on the “Home”
screen. Find and click on the latest link, which will be denoted by a filename with a date/timestamp
format: “S_yyyymmddhhmmss”. Alternatively, you can click on the

Logs button

from the top menu bar.

4.1.7 Snapshot Disk

The Ditto Forensic FieldStation provides S.M.A.R.T. and hdparm information for any source or destination
disk connected to itself. No clone or image request needs to be done.

To create a snapshot of a disk, follow these steps:

a. Select

Snapshot Disk

from the “Action to Perform” drop-down box.

b. Select the target disk from the “Target” drop-down box.

c. Click the

Start button

. A “Completed” message box will pop up when the action has finished. Click

on the message to continue.

You can view the results of the snapshot action by scrolling down to the “System Log” panel on the
“Home” screen. Find and click on the latest link, which will be denoted by a filename with a date/time-

Figure 9.

The “Action” section on the “Home” screen, showing the

options available for the “Snapshot Disk” action.

Figure 8.

The “Action” section on the “Home” screen, showing

the options available for the “Hash Disk” action.