PMS 711
2 cyan
85 magenta
76 yellow
10.25.12
CRU Mark
Page 4
4. Home Screen
4.1 Action
– The Main screen lets you start, abort, and
make notes about the following actions:
4.1.1 Clone Source Disk:
Ditto makes an exact
duplicate of the source disk. While cloning the source
disk, the Ditto is also able to hash the source drive using
MD5, SHA-1, or MD5 + SHA-1 and save the hash value.
Ditto can clone to one destination drive or two destination
drives (Mirror feature).
4.1.2 Image Source Disk:
Ditto makes a copy of the
source drive into files on to one destination drive or two
destination drives (Mirror feature). E01 and DD are the
two imaging types. While imaging the source disk, the
Ditto also can hash the source disk using MD5, SHA-
1, or MD5 + SHA-1. TIP: For fastest performance we
recommend utilizing EXT4 file system for Windows,
HFS+ for Mac, and XFS for Linux machines.
Note:
For the Mirror feature to be shown, both destination
drives must be empty. Tip: A quick way to accomplish
this is to use Ditto to erase each drive using the setting
“Clear Partition Table”.’
4.1.3 Clone and Image Source Disk:
This action
simultaneously performs a clone to one destination disk
and perform an image to the second destination disk.
Two destination disks are required for this action.
Note:
While running a clone and image, the hash
algorithm saved under clone setting will be used.
4.1.4 Erase Destination Disk:
Ditto erases the
destination drive using the pre-configured erasure
method.
4.1.5 Hash Disk:
Ditto hashes either the source or the
destination disk (user select) with the hash algorithm
pre-configured. Hash values are saved in the log.
4.1.6 Snapshot Disk:
Ditto provides SMART and
HDParm information whenever needed. No clone or
image request needs to be done.
4.1.7 NetView Scan:
NetView is a network probing
tool which can be used to discover machines on a
network and even probe them for specific services
which they may be running. This capability may help
an Investigator locate physically hidden computer and
quickly determine whether or not a machine is acting
as a data storage device which may be imaged by Ditto.
See section 4.7.1 for more information about the
NetView Scan feature.
Summary of Contents for Ditto Foensic FieldStation
Page 1: ......
Page 5: ...PMS 711 2 cyan 10 25 12 CRU Mark ...