{"id":1608,"date":"2017-04-12T08:02:03","date_gmt":"2017-04-12T06:02:03","guid":{"rendered":"http:\/\/blog.atola.com\/?p=1608"},"modified":"2022-04-19T12:52:13","modified_gmt":"2022-04-19T10:52:13","slug":"imaging-a-source-drive-to-an-e01-file-with-a-double-hash","status":"publish","type":"post","link":"https:\/\/atola.com\/blog\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/","title":{"rendered":"Imaging a Source Drive to an E01 File with a Double Hash"},"content":{"rendered":"

In recent years, E01 file format has become the de facto standard format for forensic purposes due to its ability to store not only a physical or logical copy of a source drive, but also case and evidence details. E01 file can also contain both MD5 and SHA-1 hashes. And it is considered a good practice among forensic specialists to calculate both hashes while imaging the evidence so that they are included in the E01 file.<\/p>\n

To image a source evidence drive to an E01 file you have to add a new target file.<\/p>\n

Selecting a new E01 file<\/strong><\/p>\n

1. In Imaging<\/em> category of the left-side menu you can click on Create New Session<\/em> link and in the Target Device Selection<\/em> window click on Add Image File<\/em> link.<\/p>\n

\"\"<\/p>\n

2. In the Image File Selection<\/em> window select E01 file extension in the drop-down menu to create an image file with this extension and type the name you prefer in the File Name<\/em> field.<\/p>\n

\"\"<\/p>\n

3. Fill out all the relevant fields in the Image File Options<\/em> window (you can also do it later in the Home <\/em>page of the file when it is created):<\/p>\n

\"\"<\/p>\n

4. Click on Select<\/em> button in the Target Device Selection <\/em>window.<\/em><\/p>\n

As a result you get is an E01 file with current 0 bytes capacity created (its final capacity will be defined by the amount of imaged data it contains plus the metadata).<\/p>\n

Imaging & calculating the hashes<\/strong><\/h3>\n
    \n
  1. Go to Imaging<\/em> category of the left-side menu and click on\u00a0Create New Session<\/em> link<\/li>\n
  2. In Preset<\/em> line click on the Show settings<\/em> link<\/li>\n
  3. In Passes and Hash<\/em> tab check the Hash source during imaging<\/em> box<\/li>\n
  4. In Hash method<\/em> drop-down menu select Linear<\/em><\/li>\n
  5. In Hash type<\/em> drop-down menu select MD5 and SHA-1<\/em><\/li>\n
  6. Click on Start imaging<\/em> button<\/li>\n<\/ol>\n

    \"\"<\/p>\n

    Upon completion of imaging, you will see both MD5 and SHA-1 hashes indicated in Imaging Results<\/em> page:<\/p>\n

    \"\"<\/p>\n","protected":false},"excerpt":{"rendered":"

    In recent years, E01 file format has become the de facto standard format for forensic purposes due to its ability to store not only a physical or logical copy of a source drive, but also case and evidence details. E01 file can also contain both MD5 and SHA-1 hashes. And […]<\/p>\n","protected":false},"author":8,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[35],"tags":[],"yoast_head":"\nImaging a Source Drive to an E01 File with a Double Hash<\/title>\n<meta name=\"description\" content=\"E01 files can also contain both MD5 and SHA-1 hashes. And it is considered a good practice among forensic specialists to calculate both hashes while imaging the evidence so that they are included in the E01 file.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/atola.com\/blog\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Imaging a Source Drive to an E01 File with a Double Hash\" \/>\n<meta property=\"og:description\" content=\"E01 files can also contain both MD5 and SHA-1 hashes. And it is considered a good practice among forensic specialists to calculate both hashes while imaging the evidence so that they are included in the E01 file.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/AtolaTechnology\" \/>\n<meta property=\"article:published_time\" content=\"2017-04-12T06:02:03+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-04-19T10:52:13+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/03\/1-add-image-file.png\" \/>\n<meta name=\"author\" content=\"Yulia Samoteykina\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@atola_insight\" \/>\n<meta name=\"twitter:site\" content=\"@atola_insight\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Yulia Samoteykina\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/\"},\"author\":{\"name\":\"Yulia Samoteykina\",\"@id\":\"https:\/\/atola.com\/blog\/#\/schema\/person\/f5faf6ed7d19bbc113d3d54fd30b6820\"},\"headline\":\"Imaging a Source Drive to an E01 File with a Double Hash\",\"datePublished\":\"2017-04-12T06:02:03+00:00\",\"dateModified\":\"2022-04-19T10:52:13+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/\"},\"wordCount\":321,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/atola.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/#primaryimage\"},\"thumbnailUrl\":\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/03\/1-add-image-file.png\",\"articleSection\":[\"Atola Insight Forensic\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/\",\"url\":\"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/\",\"name\":\"Imaging a Source Drive to an E01 File with a Double Hash\",\"isPartOf\":{\"@id\":\"https:\/\/atola.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/#primaryimage\"},\"thumbnailUrl\":\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/03\/1-add-image-file.png\",\"datePublished\":\"2017-04-12T06:02:03+00:00\",\"dateModified\":\"2022-04-19T10:52:13+00:00\",\"description\":\"E01 files can also contain both MD5 and SHA-1 hashes. And it is considered a good practice among forensic specialists to calculate both hashes while imaging the evidence so that they are included in the E01 file.\",\"breadcrumb\":{\"@id\":\"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/#primaryimage\",\"url\":\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/03\/1-add-image-file.png\",\"contentUrl\":\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/03\/1-add-image-file.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/atola.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Imaging a Source Drive to an E01 File with a Double Hash\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/atola.com\/blog\/#website\",\"url\":\"https:\/\/atola.com\/blog\/\",\"name\":\"Atola Blog\",\"description\":\"Atola Blog\",\"publisher\":{\"@id\":\"https:\/\/atola.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/atola.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/atola.com\/blog\/#organization\",\"name\":\"Atola Technology\",\"url\":\"https:\/\/atola.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/atola.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/atola.com\/blog\/wp-content\/uploads\/2026\/04\/Atola_technology1.jpg\",\"contentUrl\":\"https:\/\/atola.com\/blog\/wp-content\/uploads\/2026\/04\/Atola_technology1.jpg\",\"width\":840,\"height\":689,\"caption\":\"Atola Technology\"},\"image\":{\"@id\":\"https:\/\/atola.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/AtolaTechnology\",\"https:\/\/x.com\/atola_insight\",\"https:\/\/ua.linkedin.com\/company\/atola-technology\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/atola.com\/blog\/#\/schema\/person\/f5faf6ed7d19bbc113d3d54fd30b6820\",\"name\":\"Yulia Samoteykina\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/atola.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/ae740994d03c863e03a5172c3c242ddb?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/ae740994d03c863e03a5172c3c242ddb?s=96&d=identicon&r=g\",\"caption\":\"Yulia Samoteykina\"},\"description\":\"Director of Marketing Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users. Yulia regularly represents Atola at DFIR events, holds free workshops and webinars about Atola imagers functionality and advocates on the users' behalf to ensure that Atola keeps on adding value and raising the bar for the industry.\",\"url\":\"https:\/\/atola.com\/blog\/author\/yulia-samoteykinaatola-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Imaging a Source Drive to an E01 File with a Double Hash","description":"E01 files can also contain both MD5 and SHA-1 hashes. And it is considered a good practice among forensic specialists to calculate both hashes while imaging the evidence so that they are included in the E01 file.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/atola.com\/blog\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/","og_locale":"en_US","og_type":"article","og_title":"Imaging a Source Drive to an E01 File with a Double Hash","og_description":"E01 files can also contain both MD5 and SHA-1 hashes. And it is considered a good practice among forensic specialists to calculate both hashes while imaging the evidence so that they are included in the E01 file.","og_url":"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/","article_publisher":"https:\/\/www.facebook.com\/AtolaTechnology","article_published_time":"2017-04-12T06:02:03+00:00","article_modified_time":"2022-04-19T10:52:13+00:00","og_image":[{"url":"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/03\/1-add-image-file.png"}],"author":"Yulia Samoteykina","twitter_card":"summary_large_image","twitter_creator":"@atola_insight","twitter_site":"@atola_insight","twitter_misc":{"Written by":"Yulia Samoteykina","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/#article","isPartOf":{"@id":"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/"},"author":{"name":"Yulia Samoteykina","@id":"https:\/\/atola.com\/blog\/#\/schema\/person\/f5faf6ed7d19bbc113d3d54fd30b6820"},"headline":"Imaging a Source Drive to an E01 File with a Double Hash","datePublished":"2017-04-12T06:02:03+00:00","dateModified":"2022-04-19T10:52:13+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/"},"wordCount":321,"commentCount":0,"publisher":{"@id":"https:\/\/atola.com\/blog\/#organization"},"image":{"@id":"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/#primaryimage"},"thumbnailUrl":"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/03\/1-add-image-file.png","articleSection":["Atola Insight Forensic"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/","url":"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/","name":"Imaging a Source Drive to an E01 File with a Double Hash","isPartOf":{"@id":"https:\/\/atola.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/#primaryimage"},"image":{"@id":"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/#primaryimage"},"thumbnailUrl":"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/03\/1-add-image-file.png","datePublished":"2017-04-12T06:02:03+00:00","dateModified":"2022-04-19T10:52:13+00:00","description":"E01 files can also contain both MD5 and SHA-1 hashes. And it is considered a good practice among forensic specialists to calculate both hashes while imaging the evidence so that they are included in the E01 file.","breadcrumb":{"@id":"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/#primaryimage","url":"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/03\/1-add-image-file.png","contentUrl":"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/03\/1-add-image-file.png"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.atola.com\/imaging-a-source-drive-to-an-e01-file-with-a-double-hash\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/atola.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Imaging a Source Drive to an E01 File with a Double Hash"}]},{"@type":"WebSite","@id":"https:\/\/atola.com\/blog\/#website","url":"https:\/\/atola.com\/blog\/","name":"Atola Blog","description":"Atola Blog","publisher":{"@id":"https:\/\/atola.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/atola.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/atola.com\/blog\/#organization","name":"Atola Technology","url":"https:\/\/atola.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/atola.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/atola.com\/blog\/wp-content\/uploads\/2026\/04\/Atola_technology1.jpg","contentUrl":"https:\/\/atola.com\/blog\/wp-content\/uploads\/2026\/04\/Atola_technology1.jpg","width":840,"height":689,"caption":"Atola Technology"},"image":{"@id":"https:\/\/atola.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/AtolaTechnology","https:\/\/x.com\/atola_insight","https:\/\/ua.linkedin.com\/company\/atola-technology"]},{"@type":"Person","@id":"https:\/\/atola.com\/blog\/#\/schema\/person\/f5faf6ed7d19bbc113d3d54fd30b6820","name":"Yulia Samoteykina","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/atola.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/ae740994d03c863e03a5172c3c242ddb?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/ae740994d03c863e03a5172c3c242ddb?s=96&d=identicon&r=g","caption":"Yulia Samoteykina"},"description":"Director of Marketing Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users. Yulia regularly represents Atola at DFIR events, holds free workshops and webinars about Atola imagers functionality and advocates on the users' behalf to ensure that Atola keeps on adding value and raising the bar for the industry.","url":"https:\/\/atola.com\/blog\/author\/yulia-samoteykinaatola-com\/"}]}},"_links":{"self":[{"href":"https:\/\/atola.com\/blog\/wp-json\/wp\/v2\/posts\/1608"}],"collection":[{"href":"https:\/\/atola.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/atola.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/atola.com\/blog\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/atola.com\/blog\/wp-json\/wp\/v2\/comments?post=1608"}],"version-history":[{"count":1,"href":"https:\/\/atola.com\/blog\/wp-json\/wp\/v2\/posts\/1608\/revisions"}],"predecessor-version":[{"id":6497,"href":"https:\/\/atola.com\/blog\/wp-json\/wp\/v2\/posts\/1608\/revisions\/6497"}],"wp:attachment":[{"href":"https:\/\/atola.com\/blog\/wp-json\/wp\/v2\/media?parent=1608"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/atola.com\/blog\/wp-json\/wp\/v2\/categories?post=1608"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/atola.com\/blog\/wp-json\/wp\/v2\/tags?post=1608"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}