26
Protecting Your Digital Assets
TM
CRU Ditto Shark User Manual
log for the requested action. “Disabled” leaves the evidence number as it is. “Inc/Dec” allows
you to manually increment the evidence number up or down using the navigation buttons on
the face of the Ditto Shark. “AutoInc” automatically increments the evidence number, and
“AutoInc/Pause” automatically increments the evidence number, but displays a confirmation
prompt the LCD screen before beginning the requested action. These options require a number
to be present on the end of the Evidence Number specified in the “Investigation Info” section
of the “Home” screen within the Browser Interface.
•
LCD/LED Brightness:
Sets the relative brightness of the LCDs and LEDs on the face of the
Ditto Shark on a scale of 0 to 6. Setting a value of “0” will turn off all LCDs and LEDs on the
unit.
•
Buzzer:
Alerts the user to various actions that occur when using the Ditto Shark.
•
Dual Destinations:
Enables software mirroring mode to write the same data to two destina-
tions at the same time.
•
Log Disk Info:
Determines whether S.M.A.R.T. and hdparm disk information is logged before
running an action, after running an action, both, or not at all. CRU recommends that you log disk
information before and after an action.
•
HTML Logging:
Logs are always saved in XML format. This option causes the Ditto Shark to
save logs in HTML format as well.
•
DiskView Logging:
Logs any action to preview a disk (i.e. creating a disk snapshot, starting or
finishing a HexView action).
•
Force SSL:
When enabled, this setting forces any browser to use HTTPS to access the Ditto
Shark Browser Interface.
•
Stealth Mode: Turns off all LEDs and LCDs on the Ditto Shark. The physical “Stealth Mode”
Switch serves the same purpose (see Section #.#). If Stealth Mode is enabled from the
Browser Interface, the physical switch cannot override it.
•
PM Mirror Override:
Overrides the Ditto Shark’s check that tells you whether two devices
attached to the Ditto Shark can be mirrored. In some cases, attached devices may not appear
as mirrorable to the Ditto Shark because of the way their firmware implements RAID or
port-multiplication (PM). This option gives you the ability to mirror any two devices you attach
regardless of these implementations. However, the attached devices must still be empty, so
use the “Erase Destination Disk” action from the “Home” screen if the devices are not empty
(see Section 4.1.6) before attempting to mirror them.
NetCap Settings
This section allows you to modify the settings that govern network capture actions.
•
NetCap Filter:
Sets the default network capture filter for the “Network Capture” action. The
available filters are All, HTTP, E-Mail, SSH, or any available custom filter that you have saved
onto the currently installed SD card. To create your own custom filter, see Section 11.3.
•
NetCap File Count:
Specifies the maximum number of image files (based on image file seg-
ment size, see Section 5.4.1) that are created on the destination disk. When the number is
