Calculating MD5 and SHA1 hashes of an existing E01 file

Over the years, E01 file format has become a popular format for forensic purposes due to its ability to store not only the physical or logical copy of the source drive, but also case and evidence details. E01 file can also contain both MD5 and SHA-1 hashes. And it is considered a good practice among forensic specialists to calculate both hashes while imaging the evidence so that they are included in the E01 file.

To view the hash calculated for an E01 file with Atola Insight Forensic, do the following:

  1. To open the file, press the Plus icon on the Device panel and then select the E01 image files (*.E01) file extension in the drop-down menu to view existing files with this extension.

  2. On the Home screen, look through the File History and click on the Imaging target link.

  3. The Imaging target report opens. At the bottom the are both hashes calculated during the imaging session.

    4. Leave this window open or save the report as a pdf file to compare the hash with the newly calculated one later.

  4. In the sidebar, go to Hashing > Calculate Hash.
  5. In the Hash method list, select Linear.
  6. In the Hash type list, select MD5 and SHA-1.
  7. Click Start.

  8. Once the hashes are calculated, you can make sure that the two sets of hashes are identical.

Back to Manual start page