CRU Ditto Forensic FieldStation User Manual

Page 8

Protecting Your Digital Assets

Ditto Forensic FieldStation User Manual

d. Select the destination disk for the image from the “Destination” drop-down box. To image to two

destination disks at the same time, select the

Mirror

option. Destinations do not have to be the same

physical media as the source disk, but each must be larger than the source disk.

For the Mirror feature to be shown, both destination disks must be empty. A quick way to accomplish

this is to use the Ditto Forensic FieldStation to erase each disk by selecting

Erase Destination Disk

from the “Action to Perform” drop-down box and clearing each disk’s partition table (see Section 4.1.5).

You must also go to the

Erase tab

on the “Configure” Screen and make sure that “Format After Erase”

is unchecked (see Section 5.6), because if a destination disk has a partition on it, the “Mirror” option

will not appear.

e. Select which type of physical image you would like to create from the “Physical Image Type” drop-

down box. The image types available are

E01

. (You can modify which image type appears by

default in the drop-down box on the “Configure” screen’s “System” tab. See Section 5.1.)

f. Click the

Start button

. A “Completed” message box will pop up when the action has finished. Click

on the message to continue.

You can increase the performance of the operation by clicking off of the browser interface window so

that it is not continually updated.

You can view the results of the image action by scrolling down to the “System Log” panel on the “Home”
screen. Find and click on the latest link, which will be denoted by a filename with a date/timestamp
format: “S_yyyymmddhhmmss”. Alternatively, you can click on the

Logs button

from the top menu bar.

4.1.3 Logical Image Source Disk

Logical imaging allows an investigator to quickly scan the contents of a hard disk and image only the files
and folders relevant to the investigation into an L01, ZIP, TAR, or LIST file format. Data can be imaged to
one or two destination disks. To create a logical image, follow these steps:

a. Select

Logical Image Source Disk

from the “Action to Perform” drop-down box.

b. Select the source disk to image from the “Source” drop-down box, then choose which of the

partition(s) to image from the “Partition” drop-down box.

c. Select the destination disk for the logical image from the “Destination” drop-down box, then choose

the destination disk partition from the “Partition” drop-down box. To image to two destination disks at
the same time, select the

Mirror

option. Destination disks do not have to be the same physical media

as the source disk, but each must be larger than the source disk.

NOTE

Figure 4.

The “Action” section on the “Home” screen, showing

the options available for the “Logical Image Source Disk” action.