CRU Ditto Forensic FieldStation User Manual

Page 7

Protecting Your Digital Assets

Ditto Forensic FieldStation User Manual

To clone, follow these steps:

a. Using the browser interface, select

Clone Source Disk

from the “Action to Perform” drop-down box.

b. Select the source disk to clone from the “Source” drop-down box.

c. Select the destination disk from the “Destination” drop-down box. To clone to two destination disks at

the same time, select the

Mirror

option. Destination disks do not have to be the same physical media

as the source disk, but each must be larger than the source disk.

For the Mirror feature to be shown, two destination disks must be attached.

d. Click the

Start button

. A “Completed” message box will pop up when the action has finished. Click

on the message to continue.

You can increase the performance of the operation by clicking off of the browser interface window so

that it is not continually updated.

You can view the results of the clone action by scrolling down to the “System Log” panel on the “Home”
screen. Find and click on the latest link, which will be denoted by a filename with a date/timestamp
format: “S_yyyymmddhhmmss”. Alternatively, you can click on the

Logs button

from the top menu bar.

4.1.2 Physical Image Source Disk

The Ditto Forensic FieldStation creates an E01 or DD image of the source disk on one or two destination
disks.

While imaging the source disk, the Ditto Forensic FieldStation can also hash the source disk using the

MD5, SHA-1, or MD5 + SHA-1 algorithms. Select the hash type under the “System Settings” panel

on the “Home” screen. See Section 4.3. Hashing while using both MD5 + SHA-1 significantly reduces

performance.

For the fastest performance, we recommend utilizing an NTFS file system for Windows, HFS+ for Mac,
or XFS for Linux machines. To create a physical image, follow these steps:

a. Using the browser interface, select

Physical Image Source Disk

from the “Action to Perform” drop-

down box.

b. Select the source disk to image from the “Source” drop-down box.

c. Select which partition(s) to image from the “Partition” drop-down box. Choose

All

to image the entire

source disk.

Figure 2.

The “Action” section on the “Home” screen, showing

the options available for the “Clone Source Disk” action.

Figure 3.

The “Action” section on the “Home” screen, showing

the options available for the “Physical Image Source Disk” action.

NOTE