CRU Ditto Forensic FieldStation User Manual
Page 18
18
Protecting Your Digital Assets
TM
Ditto Forensic FieldStation User Manual
5.4.1 E01
Click on the
E01 tab
to reveal the E01 image settings.
Typical Settings
•
Image File Segment Size:
Allows you to specify the size in bytes that image file segments
should be. The minimum size is 1M (megabyte). The maximum size is limited by the target file
system. If this field is left blank, the maximum size will be used. Click the “I” information icon
for more information.
•
Source HPA/DCO:
Sets whether the physical image action should indicate in the log that there
is an HPA (host protected area) or DCO (device configuration overlay) present, temporarily
bypass the HPA, permanently unhide the HPA, or permanently unhide both the HPA and DCO.
•
Compression Type:
Sets whether the action should use empty block compression or no com-
pression.
•
EWF File Format:
Choose which EnCase image file format should be used during E01 physical
images. CRU recommends using “encase6” for most acquisitions.
Advanced Settings
The advanced settings may be hidden. Click the
Show button
to reveal them.
•
Buffer Size:
Sets the the buffer size used by the Ditto Forensic FieldStation during an E01
physical image action. The minimum size is 512K (kilobytes). The default size of 1M (megabyte)
works best for most uses. The maximum size is limited by the target file system.
•
Swap Byte Pairs of the Media Data (endian conversion):
Check this box if you need to
convert from big-endian to little-endian or vice-versa, which may be necessary for disks used in
older x86 or PowerPC-based systems.
•
Wipe Sectors on Read Error (mimic EnCase-like behavior):
If a read error is encountered
during an E01 physical image action, the Ditto Forensic FieldStation will write out zeroes to fill
the sector.
•
Read Error Retries:
Specifies the number of tries the Ditto Forensic FieldStation will try to read
a sector before moving on to the next sector.
5.4.2 DD
Click on the
DD tab
to configure the DD image settings.
Typical Settings
•
Image File Segment Size:
Allows you to specify the size in bytes that image file segments
should be. The minimum size is 1M (megabyte). The maximum size is limited by the target file
system. If this field is left blank, the maximum size will be used. Click the “I” information icon
for more information.
•
Source HPA/DCO:
Sets whether the physical image action should indicate that there is an HPA
(host protected area) or DCO (device configuration overlay) present, temporarily bypass the
HPA, permanently unhide the HPA, or permanently unhide both the HPA and DCO.