CRU Ditto Forensic FieldStation - Manual (Page 21)

21
Protecting Your Digital Assets TM
Ditto Forensic FieldStation User Manual
uration overlay) present, temporarily bypass the HPA, permanently unhide the HPA, or permanently
unhide both the HPA and DCO.
• Passes: For the “Custom Erase” setting only, this allows you to specify the number of passes the
disk is overwritten during the erase action. You can specify between 1 and 99 passes.
• Overwrite Method: For the “Custom Erase” setting only, you can specify a pattern for the disk to
write repeatedly across the entire disk. If “text” is selected from the drop-down box, the “Pattern”
field must contain one or more ASCII characters. If “hex” is selected, the “Pattern” field must con-
tain an even number of ASCII characters representing hexadecimal digits (e.g. 17a64F). Leaving the
“Pattern” field blank tells the Ditto Forensic FieldStation to use zeroes.
• Verify: This is a planned feature that is not currently implemented. The “Verify” drop-down box will
allow you to verify the erased disk after it has been fully erased. If “Quick” is selected, the begin-
ning, middle, and end of the disk will be read to ensure that the last pattern was actually written. If
“Full” is selected, the entire disk will be read to ensure that the last pattern was actually written. If
“None” is selected, no verification will be performed.
• Format After Erase: Check this box to format the disk with the default format. The default format
can be set in the “System” tab on the “Configure” screen (see Section 5.1).
5.7 HASH
The “Hash” tab allows you to view and customize the following settings for all hash
actions. When you are finished, click the
Commit Changes button to save the changes.
• Buffer Size: Sets the the buffer size used by the Ditto Forensic FieldStation
during a hash action. The minimum size is 512K (kilobytes). The default size of
1M (megabyte) works best for most uses. The maximum size is limited by the
target file system.
• Exit when a bad sector is encountered: Aborts the hash disk action if the
Ditto Forensic FieldStation encounters a bad sector on the target disk.
5.8 NAMING
The “Naming” tab allows you to customize how the Ditto Forensic FieldStation names
directories and files during imaging actions. When you are finished, click the
Commit
Changes button to save the changes.
As shown in Figure 21, the file directory or file name used in imaging actions can be a
name that contains up to four user-selectable fields. As you customize these fields, the
“Directory Name Template”, “Final Directory Name”, “File Name Template”, and “Final
File Name” fields will update. The template fields show the order of variables will appear
in the name, whereas the final name fields display the directory or file name using the
actual information from the “Investigation Info” panel on the “Home” screen and the
source disk.
5.8.1 Variables
To modify the any of the user-customizable variables, navigate to the “Investigation
Info” panel on the “Home” screen (see Section 4.2).
Figure 21. The “Naming” tab on the “Configure”
screen.