10
Protecting Your Digital Assets
TM
CRU Ditto Shark User Manual
b. Select the Erase Mode to use from the “Erase Mode” drop-down box. (You
can modify which erase mode appears by default in the drop-down box on the
“Confi gure” screen’s “System” tab. See Section 5.1.)
c. Select the target destination media from the “Target” drop-down box.
d. Click the
Start button
. A “Completed” message box will pop up when the
action has fi nished. Click on the message to continue.
You can view the results of the erasure action by scrolling down to the “System
Log” panel on the “Home” screen. Find and click on the latest link, which will be
denoted by a fi lename with a date/timestamp format: “S_yyyymmddhhmmss”.
Alternatively, you can click on the
Logs button
from the top menu bar.
Format After Erase
You can confi gure the Ditto Shark to automatically format a disk after you erase
it. Make sure that
Erase Destination Disk
is selected from the “Action to
Perform” drop-down box. Then click on the
Confi gure button
. Make sure that
“Format After Erase” is checked for each of the erase modes on which you’d
like to enable this setting. Finally, click
OK
.
4.2 INVESTIGATION INFO
The Investigation Info panel groups related information that may also be used in
creating custom directories and fi le names (see Section 5.9). The “Hide” button allows
you to minimize the panel.
Click the
Edit button
to enter information about the Investigator, Case Number,
Evidence Number, Description, Notes, Base directory prefi x, and a Base fi lename prefi x
for a PCAP fi le.
Each fi eld is fi ltered to block non-printable ASCII characters. Any characters at the fi le
system level that may not be safe for a directory name or fi le name will be fi ltered out
and replaced with an underscore. Only printable ASCII characters are currently allowed
for directory and fi lenames. Multiple underscores will also be reduced to a single
underscore per naming item.
The Ditto Shark will generate an error message if you enter a non-printable ASCII char-
acter or if your message exceeds the 58 character limit. Additionally, when the fi nal
directory or fi lename that uses any of these fi elds is created, another level of fi ltering is
applied.
Using apostrophes (‘) in the name fi elds will cause an error when the fi le or
folder name is created. They should not be used in the Investigation Info fi elds.
4.2.1 User Defi ned Fields
Click on the
green plus sign icon
to open the “Add User Defi ned Field” window
(see Figure 11). You may add as many user defi ned fi elds as you wish. Each user
defi ned fi eld must have a title, XML tag, and value.
Figure 11.
The “Add User Defi ned Field” window.
STOP!
Figure 9.
The “Investigation Info” section.
