Imaging a drive to two targets with post-hashing
Atola TaskForce's imaging functionality provides many adjustable settings to help forensic examiners follow the guidelines set by their organizations as well as common-sense evidence handling routines.
When you need to create two images of a source drive and verify that both images are identical to the source drive, you will need to calculate the hashes of both targets after imaging. To optimize the process, post-hashing of both target devices is easily configured in imaging settings:
1) Click Image button in the left-side menu
2) Select Source and Target devices, which will redirect you to the page with the summary of current imaging settings. In the default settings, hashing of source drive during imaging is enabled.
3) Click the Change button to adjust the settings.
Change default imaging settings
4) in the Hashes tab of the settings, enable Post-hash target devices option.
5) Click Start button to proceed with imaging
Select post-hashing of targets
Hashing of source drive during imaging is a preferred option because it only requires the data on the evidence drive to be read once, for both imaging and hash calculation. This ensures both a forensically sound process and minimal impact to potentially unstable media. Hashing during imaging does not slow down imaging process.
Imaging progress
Once imaging is completed, post-hashing begins immediately on both target devices:
Post-hashing in progress
In the end, TaskForce produces a report that documents hashes of both source and target devices:
Imaging report with source and target hashes
