Calculating hash during imaging
Atola TaskForce 2 supports hash calculation of both the evidence drive and the image in conjunction with imaging. We have developed highly flexible functionality to help optimize evidence acquisition process to fit one’s internal procedures, while avoiding further damage to fragile media.
To calculate hash of both the evidence and the image:
- On the left, click Image.
- Select the source and target device.
- On the imaging Settings page, click Change.
- On the Hashes tab, toggle one or several options how you want to calculate hash:
- Pre-hash source device
- Hash source during imaging
- Post-hash target device
Pre-hash source drive option must be used with caution: although pre-hashing can be required by an investigator’s internal procedures, when dealing with drives that have been diagnosed with hardware failure, this operation may cause further damage to the drive before essential data is imaged.
Hash source during imaging is the most appropriate way to calculate the hash of a fragile source evidence drive. In this case, TaskForce 2 only needs to read the data on the drive once to both image and calculate the hash, thus minimally using the drive’s hardware.
Post-hash target device option lets you to properly record the calculated hash in the case.