Calculating dual hash of an existing E01 file
Some source evidence drives and their images can be involved in a long-running investigation case and wait to be presented in court for months or years on end. Data stored on such drives and their image files may eventually get corrupt. Therefore it may be critical for an investigator to ensure the integrity of data on such devices or image files before resuming to work with them or presenting them in court.
Over the years, E01 file format has become a popular format for forensic purposes due to its ability to store not both the image of the drive, but also case and evidence details. E01 file can also contain both MD5 and SHA-1 hash values.
View the previously calculated hash
To view the previously calculated hash calculated for an E01 file with Atola TaskForce, open the imaging report in the case management system. It contains the hash values calculated during imaging.
Alternatively, you can look up the metadata stored in the E01 file itself:
- At the top, click Devices.
- Expand the File category and click Select file.
- Select the E01 file in the file browser.
Hash calculated during imaging stored in E01 file's metadata.
Recalculate the hash for an E01 file
To ensure the integrity of the data in the file, you can recalculate its hash.
- On the left, click Other, and then Hash.
- To choose the file for which you want to calculate hash, expand the File category and click Select file.
- Select the E01 file in the file browser.
- Adjust hashing settings. Make sure to select the same hashing types (MD5, SHA1, etc.)
- Click Start.
Starting hash calculation.
When the hash calculation is completed, you can make sure that the two sets of hashes are identical.
Comparing the calculated hash values to the ones calculated during imaging.
