Imaging to an E01 file with dual hash
E01 file format is the de facto standard format for forensic examiners to store images due to its ability to store not only a copy of the evidence drive, but also case and evidence details. E01 file can also store both MD5 and SHA1 hash values calculated during imaging.
To image a source evidence drive to an E01 file, you have to create a new target file.
Creating a new E01 file
- Click Image in the left-side menu
- Select the source evidence drive in Select source device window
- Click Select file in Select target devices panel
- In the file selector, find the folder to store the image and click the plus (+) button in the bottom right corner
- In the pop-window, select the E01 file type, and click Create button
- Fill in E01 file information and click Create button.
- Click Continue button.
Create an E01 file
Enable dual-hash and start imaging
- Once you have selected the source drive and created the target file, you end up in Settings summary page. Click Change button to adjust the imaging settings.
- In the Hashes tab make sure that Hash source during imaging is selected, also select both MD5 and SHA1 hash types.
- Click Start button to proceed with imaging.
Adjust imaging settings
The report and the E01 file
Imaging report
Upon completion of imaging, you can see both MD5 and SHA1 hash values indicated in the Imaging completed report.
E01 file with calculated MD5 and SHA1 hashes
It is also possible to look up the information of the created E01 file. To do that, perform the following actions:
- Open the Devices menu by clicking the Devices button in the upper right corner.
- There, in the File section, click the Select file box. This will open the file information page with all the metadata of the E01 file.
The MD5 and SHA hash values will be listed there, too.
