Calculating MD5 and SHA-1 hashes of an existing E01 file

Over the years, the E01 file format has become a popular format for forensic purposes due to its ability to store not only the physical or logical copy of the source drive, but also case and evidence details. An E01 file can also contain both MD5 and SHA-1 hashes. It is considered good practice among forensic specialists to calculate both hashes while imaging the evidence so that they are included in the E01 file.

To view the hash calculated for an E01 file with Atola Insight Forensic, do the following:

  1. To open the file, press the Plus icon on the Device panel and then select the E01 image files (*.E01) file extension in the drop-down menu to view existing files with this extension.

  2. On the Home screen, look through the File History and click on the Imaging target link.

  3. The Imaging target report opens. At the bottom, there are both hashes calculated during the imaging session.

    4. Leave this window open or save the report as a PDF file to compare the hash with the newly calculated one later.

  4. In the sidebar, go to Hashing > Calculate Hash.
  5. In the Hash method list, select Linear.
  6. In the Hash type list, select MD5 and SHA-1.
  7. Click Start.

  8. Once the hashes are calculated, you can make sure that the two sets of hashes are identical.

Back to Manual start page