CRU Ditto Forensic FieldStation User Manual

Page 9

Protecting Your Digital Assets

Ditto Forensic FieldStation User Manual

For the Mirror feature to be shown, both destination disks must be empty. A quick way to accomplish

this is to use the Ditto Forensic FieldStation to erase each disk by selecting

Erase Destination Disk

from the “Action to Perform” drop-down box and clearing each disk’s partition table (see Section 4.1.5).

You must also go to the

Erase tab

on the “Configure” Screen and make sure that “Format After Erase”

is unchecked (see Section 5.6), because if a destination disk has a partition on it, the “Mirror” option

will not appear.

d. Select which type of logical image you would like to create from the “Logical Image Type” drop-down

box. The format options available are L01, TAR, ZIP, or LIST. (You can modify which logical image type
appears by default in the drop-down box on the “Configure” screen’s “System” tab. See Section 5.1.)

“Logical Image Source Disk” actions create a report of directories and files chosen from the source disk

as well as their file sizes and any error messages encountered. This report can be viewed from within

the browser interface and can be exported as an Excel spreadsheet. See Section 7.1.4.

e. Click on

Select Files & Dirs

. A dialog box will open.

f. Use the navigation tree to select the files and folders you wish to image (See

Figure 5).

g. Click the

Start button

at the bottom of the dialog box. A “Completed” message

box will pop up when the action has finished. Click on the message to continue.

You can view the results of the logical image action by scrolling down to the “System
Log” panel on the “Home” screen. Find and click on the latest link, which will be
denoted by a filename with a date/timestamp format: “S_yyyymmddhhmmss”.
Alternatively, you can click on the

Logs button

from the top menu bar.

4.1.4 Clone and Image Source Disk

This action simultaneously creates a clone of the source disk on one destination disk and creates an image
on a second destination disk.

Two destination disks are required for this action.

While cloning and imaging the source disk, the Ditto Forensic FieldStation can also hash the source disk

using the MD5, SHA-1, or MD5 + SHA-1 algorithms. Select the hash type under the “System Settings”

panel on the “Home” screen. See Section 4.3. Hashing while using both MD5 + SHA-1 significantly

reduces performance.

To simultaneously create a clone and a physical image of the source disk, follow these steps:

a. Select

Clone & Image Source Disk

from the “Action to Perform” drop-down box.

b. Select the source disk to clone and image from the “Source” drop-down box.

Figure 6.

The “Action” section on the “Home” screen, showing

the options available for the “Clone & Image Source Disk” action.

NOTE

Figure 5.

The File Navigation Tree.

NOTE