{"id":1208,"date":"2016-11-30T16:03:52","date_gmt":"2016-11-30T14:03:52","guid":{"rendered":"http:\/\/blog.atola.com\/?p=1208"},"modified":"2022-12-19T16:53:09","modified_gmt":"2022-12-19T14:53:09","slug":"atola-insight-forensic-4-7-segmented-hashing","status":"publish","type":"post","link":"https:\/\/atola.com\/blog\/atola-insight-forensic-4-7-segmented-hashing\/","title":{"rendered":"Atola Insight Forensic 4.7 – Segmented hashing"},"content":{"rendered":"

Atola Insight Forensic 4.7 is released!<\/p>\n

This release comes with the new hashing concept which protects you from damaged target images and works in parallel with the multi-pass imaging engine.<\/p>\n

The full list of Atola Insight Forensic 4.7 changes can be found here: Atola Insight Forensic Changelog<\/a>.<\/p>\n

How is segmented hashing different from regular hashing?<\/h3>\n

With regular hashing, you get a single hash for the entire image.<\/p>\n

With segmented hashing, you end up with many hashes of corresponding LBA ranges (chunks) of the image. The sum of these LBA ranges represents the entire image, just not necessarily in sequential order. By validating all hashes in a set, you can still prove that the entire image was not modified.<\/p>\n

All segment hashes are saved in a CSV file with the following simple format:<\/p>\n

Hash,start LBA,end LBA<\/pre>\n
Example:<\/em><\/p>\n
75c92419e86ce82734ef3bbb781e6602,0,8388608\r\ne2c7fc5264bae820e46c50b0502236d3,8388609,16777216\r\n42718e48b5adb59563c98727cbce0619,16777217,25165824<\/pre>\n
… And so on until the last LBA.<\/p>\n
Segmented hashes\u00a0for multi-pass imaging<\/h3>\n
Conventional hashing algorithms prevent imaging source evidence in a non-linear way, which means no proper hash calculation when imaging damaged evidence drives. Enabling segmented hashing allows the use of multiple passes and more efficient handling of damaged drives, while still hashing all good areas.<\/p>\n
Hashes are calculated only for the imaged regions, while all bad sectors are excluded from the calculation.<\/p>\n
\"Segmented<\/p>\n
Better resiliency<\/h3>\n
Another reason to use segmented hashes is to provide for better resiliency against target image data corruption. If your acquired evidence image is damaged at some point in the future, with regular hashes you will get a hash mismatch upon verification, and the entire image becomes useless, whereas with segmented hashes only one hash from a set becomes invalid.<\/p>\n
Example – imaging with segmented hashing enabled<\/h3>\n
Here are imaging results with the link to segmented hashes file.<\/p>\n
\"Imaging<\/p>\n
Segmented hashes are saved in a CSV file with the simple “Hash,start LBA,end LBA” format:<\/p>\n
\"Segmented<\/pre>\n
<\/h3>\n
Example – verification of segmented hashes<\/h3>\n
There is a new operation added to Atola Insight – Verify Segmented Hashes. It is an automated way to take existing CSV files containing segmented hashes and verify all of them against the target image.<\/p>\n
Let us take a closer look at the example to see how it works.<\/p>\n
Step 1.<\/strong> First, let’s simulate a change of the evidence image. We can do so by selecting the target image and changing one byte at sector #35,000,000.<\/p>\n
\"Change<\/p>\n
 <\/p>\n
Step 2.<\/strong> Now we go to Verify Segmented Hashes. Select the file with segmented hashes calculated during imaging and click Start.<\/p>\n
\"Start<\/p>\n
 <\/p>\n
Step 3.<\/strong> Hash verification is in progress. Here we see 18 segmented hashes checked. Hash for the interval that includes sector 35,000,000 is invalid.<\/p>\n
\"Segmented<\/p>\n
 <\/p>\n
Step 4.<\/strong> Hash verification finishes\u00a0with the proper case report automatically created.<\/p>\n
\"Segmented<\/p>\n
 <\/p>\n
If you want to learn more about other 4.7 changes, visit this page: Atola Insight Forensic Changelog<\/a>.<\/p>\n
Where to buy<\/h3>\n
If you still do not have an Atola Insight Forensic and would like to place an order, this can be done directly via Atola Technology, or from a distributor near you:<\/p>\n
https:\/\/atola.com\/wheretobuy\/<\/a><\/p>\n