WiebeTech Ditto DX Forensic FieldStation User manual

Protecting Your Digital Assets

Wiebetech Branding

2c85m76y

PMS 711C

66c7m7y

PMS 299C

Product Name:

Univers 73 Black Extended

abcdefghijklmnopqrstuvwxyz

ABCDEFGHIJKLMNOPQRSTUVWXYZ

CRU

WiebeTech

Ditto

DX Forensic FieldStation

User Manual

Features

• Createlocal,remote,ornetworkeddiskclonesandimages

• CongureandmanageDittoDXviaaVPN,network,orontheunititself

• TimesavinglogicalimagingtwiceasfastastheoriginalDittoForensicFieldStation

• Nativelysupportswrite-blockedSATA,eSATA,PATA,andUSB3.0/2.0

• Write to dual destinations simultaneously - Any combination of eSATA, USB 3.0, or

GigabitEthernet

• OutputimagestoportableRAIDenclosures,NASunits,andothernetworkdestinations

• Dataacquisitionmodes–Clone,DD,E01,L01,andsimultaneousclone&image

• Hashtypes–MD5,SHA-1,MD5+SHA-1,SHA-256,MD5+SHA-256

• Securelysanitizedriveswithpreseterasemodesorausercongurablepattern

• StealthModeavailableforusewithnightvisiongoggles(notincluded)

Protecting Your Digital Assets

Ditto DX Forensic FieldStation User Manual

TABLE OF CONTENTS

1GeneralInformation 3

1.1PackageContents 3

1.2IdentifyingParts 3

1.3LightbarStatus 4

1.4ThermalManagement 4

2Setup 4

3BrowserInterface 5

3.1AccessingtheBrowserInterface 5

3.2IconsUsedintheBrowserInterface 7

3.3UserAccounts 8

4HomeScreen 8

4.1Action 9

4.1.1CloneSourceDisk 9

4.1.2PhysicalImageSourceDisk 9

4.1.3LogicalImageSourceDisk 10

4.1.4CloneandImageSourceDisk 12

4.1.5RestorePhysicalImage 13

4.1.6EraseDestinationDisk 14

4.1.7HashDisk 14

4.1.8SnapshotDisk 15

4.1.9NetViewScan 15

4.2InvestigationInfo 15

4.3SystemSettings 16

4.4CurrentStatus 16

4.5Disks 16

4.5.1PreviewingandBrowsingDisks 17

4.5.2ViewHexidecimalData 18

4.5.3ViewSnapshotData 18

4.6SystemLog 18

5CongureScreen 19

5.1System 19

5.2Network 21

5.3Clone 25

5.4PhysicalImage 25

5.5LogicalImage 27

5.6Restore 28

5.7Erase 28

5.8Hash 30

5.9Naming 30

5.10QuickStart 31

6AdminScreen 31

6.1UserAccounts 31

6.2Permissions 31

6.3AddingaNewUser 32

6.4EditinganExistingUser 32

6.5DeletingaUser 33

7LogsScreen 33

8UtilitiesScreen 34

9UsingtheFrontPanelInterfaceinStandaloneMode 35

10StealthMode 40

11AdvancedFeaturesandFunctions 41

11.1NetviewScan 41

11.2TargetMode:RemotelyAccessDisksAttachedto

theDittoDXForensicFieldStationwithThirdParty

Software

11.3UsingiSCSIDevices 44

11.4UsingNFSandSMB(Samba)Shares 47

11.5AddingaNewAutoSelectLogicalImageProle 48

12UpgradingFirmware 49

13TechnicalSpecications 51

Protecting Your Digital Assets

Ditto DX Forensic FieldStation User Manual

1 GENERAL INFORMATION

1.1 PACKAGE CONTENTS

Thefollowing listcontains theitems that are included inthe

completecongurationforthisdevice.PleasecontactCRUif

anyitemsaremissingordamaged:

DittoDXForensicFieldStationUnit 1

UnitizedSAS-to-eSATA+Mini-Fitpowercable 3

IDEcable 1

12Vpowersupply 1

Powercord 1

Legacypower-to-Mini-Fitcable 1

Ethernetcable(RJ45) 1

Poweradapter,legacy-to-SATA 1

Velcrocablewrap 6

eSATAcable 2

8GBSDcard(pre-installed) 1

1.2 IDENTIFYING PARTS

Take a moment to familiarize yourself with the parts of the

Ditto DX Forensic FieldStation. This will help you to better

understandthefollowinginstructions.

SOURCE INPUTS

(allinputsarewrite-blocked)

DESTINATION OUTPUTS

CONTROL INTERFACE

TOP OF UNIT

Protecting Your Digital Assets

Ditto DX Forensic FieldStation User Manual

1.3 LIGHTBAR STATUS

COLOR STAT E DESCRIPTION

Teal Solid Idle

Magenta Solid Anactionisinprogress

Green Solid Anactionhassuccessfullycompleted

Red Solid Anerrorhasbeendetectedortherunningactionhasbeenabortedbytheuser

Amber

Solid

Theprocessorisclosetoreachingitsrecommendedthermallimit.CRUsuggeststhatyouusethe

DittoDXexternalfan(soldseparately).

Blinking

ThecurrentlyrunningactionhasbeensuspendedbytheDittoDXForensicFieldStation’sthermal

managementandwillautomaticallyresumefromwhereitleftoffwhentemperatureshavesufciently

lowered.

1.4 THERMAL MANAGEMENT

TheDittoDXForensicFieldStationisapassivelycooledsystemthatpullsheatoutoftheprocessorandother

electronicsintothealuminumhousingwhereitdissipates.TheheatgeneratedbytheDittoDXForensicField-

Stationisanintendeddesignfeaturethateliminatestheneedofanoisyinternalcoolingfananddrastically

reducestheamountofparticulatesthatarepulledthroughthesystem.

Thepassivelycooledsystemincludesautomaticthermalmonitoringandprotection.IftheDittoDXForensic

FieldStationdetectsthattheinternaltemperatureisreachingaspecicthreshold,theLightbarwillchange

toamberandamessagewillbepresentedonthefrontpanelLCDsuggestingthatanexternalfanmaybe

required.Ifthetemperaturecontinuestoincreaseandreachesthesecondarythreshold,theDittoDXForensic

FieldStationwillsuspendanycurrentlyrunningactionandtheLightbarwillbeginblinkingamber.Oncethe

internaltemperaturelowers,theactionwillresumeautomaticallyfromwhereitleftoff.

IfyouareoperatingtheDittoDXForensicFieldStationinanenvironmentwarmerthan95°F/35°C,CRUrec-

ommendstheuseofanexternalfan(verylittleairmovementisrequired).CRUofferssuchafanspecically

designedforusewithDittoDX(PartNumber:30000-0100-0001).TheDittoDXfanispoweredfromoneofthe

USB2portsonthecontrolinterfaceandoperatesveryquietly.

2 SETUP

TheControl InterfacesideoftheDittoDXForensicFieldStationhasapowerswitchand12Vinputfortheincluded

powersupply,anSDcardslot,twoUSB2.0portsforusewithakeyboardorwiadapter,anRJ45gigabitEthernet

porttoallownetworkaccesstotheDittoDX’sbrowserinterface(seeSection3),andastealthswitchthatwillturn

offallexternallightsandenablenightvisionmode(seeSection10).

Plugthe“suspect”disksordevicesintotheSource InputssideoftheDittoDXForensicFieldStation.Allsource

inputsarewrite-blockedtopreventalteration.ThesourceinputsincludeaUSB3.0portforUSBdevices,anRJ45

gigabitEthernetport,anIDE/PATAdiskport,aneSATAportforSATAdisksoraneSATAdevice,andaPCIex4

portwhichcanbeusedwiththeDittoDXPCIeAdapterBundle,andtheSASandFireWireexpansionmodules,

allsoldseparately.

UsetheDestination OutputssideoftheDittoDXForensicFieldStationtostoreacquireddata.Thedestination

outputconnectionsincludetwoUSB3.0portsforUSBdevices,anRJ45gigabitEthernetport,atwoeSATAports

forSATAdisksoreSATAdevices,andaPCIex4portwhichcanalsobeusedwiththeabovementionedPCIe

adapterbundleandexpansionmodules.

CRUrecommendsthatyouswitchthepowerofftotheDittoDXwhenyouaddorremoveadevicefrom

itinordertoavoiddiskdamageanddatacorruption.

NOTE

Protecting Your Digital Assets

Ditto DX Forensic FieldStation User Manual

3 BROWSER INTERFACE

TheDitto DXForensicFieldStation can becongured and operated either fromthe Front

Panel(seeSection9)orthroughawebbrowser.

3.1 ACCESSING THE BROWSER INTERFACE

3.1.1 Accessing Via Network

a. PluganEthernetcableintotheEthernetportonthe“ControlInterface”sideof

theDittoDXForensicFieldStation.

b. ConnecttheotherendoftheEthernetcabletoyournetwork.Thisusuallymeans

pluggingitintoarouterorhub.Inanofceenvironment,youmayhaveanetwork

jackbuiltintoyourofcewall.

c. ConnectthepowercabletotherearoftheDittoDXForensicFieldStationandto

theprovidedACadapter.

d. TurnontheDittoDXForensicFieldStation’spowerusingtheswitchontherear

panel.(0=off,1=on)

e. IfyouhavepreviouslyconguredtheDittoDXandyouknowtheIPaddressit

uses,godowntothelaststepofthissection.IfyouhavenotconguredtheDitto

DX,useoneofthetwofollowingwaystocongureit.

Conﬁgure Ditto to Use DHCP

DHCPisthe protocolused bymost networkenvironmentstoday. Unless your

networkadministratordirectsotherwise,youshouldprobablyfollowthesesteps.

a. PresstheDownnavigationbuttonontheDittoDXForensicFieldStationuntil

youreachthe“Settings”menu(seeFigure1).ThenpresstheRight naviga-

tionbuttontoviewtheSettings.

b. PressUporDownuntilyoureachthe“CtlNetworkSettings”screenshown

inFigure2andpressRight.

c. PressUporDownuntilyoureachthe“CtlNetwork”screenshowninFigure

3.

d. Ifthetextonthesecondlinesays“Disabled”,presstheRightbuttontoedit

thesetting.PressUponceandthenRighttocommitthechange.Ifthetext

says“Enabled”,continuetothenextstep.

e. PressUporDownuntilyoureachthe“CtlNetworkMode”screenshown

inFigure4.

f. Ifthetextonthesecondlinesaysanythingotherthan“Client(DHCP)”,press

Righttoeditthesetting.PressUpuntilthesecondlinesays“Client(DHCP)”

andthenpressRighttocommitthechange.Ifthetextalreadysays“Client

(DHCP)”,continueontothenextstep.

g. Press Up or Down until you reach the“Ctl IP Address” screen shown in

Figure5.

h. ContinuetoStepGbelowtologintothebrowserinterface.

CtlNetworkSettings

View/Edit>

Figure 2. A depiction of the “Ctl Network Settings”

screenontheDittoDXForensicFieldStation.

CtlNetworkMode:

Client(StaticIP)

   Edit>

Figure 4. A depiction of the “Ctl Network Mode”

screenontheDittoDXForensicFieldStation.

CtlIPAddress:

10.10.0.1

   Edit>

Figure 5.Adepictionofthe“CtlIPAddress”screenon

theDittoDXForensicFieldStation.

CtlNetwork:

Disabled

   Edit>

Figure 3.Adepiction ofthe“CtlNetwork”screen on

theDittoDXForensicFieldStation.

Settings

View/Edit>

Figure 1. A depiction of the “Settings”menu on the

DittoDXForensicFieldStation.

Protecting Your Digital Assets

Ditto DX Forensic FieldStation User Manual

Conﬁgure Ditto to Use a Static IP Address

IfyournetworkadministratordirectsyoutouseastaticIPaddress,followthesesteps.

a. PresstheDownnavigationbuttonontheDittoDXForensicFieldStationuntilyoureachthe“Set-

tings”menu(seeFigure1).ThenpresstheRight navigationbuttontoviewtheSettings.

b. PressUporDownuntilyoureachthe“CtlNetworkSettings”screenshowninFigure2andpress

Right.

c. PressUporDownuntilyoureachthe“CtlNetwork”screenshowninFigure3.

d. Ifthetextonthesecondlinesays“Disabled”,presstheRightbuttontoeditthesetting.PressUp

onceandthenRighttocommitthechange.Ifthetextsays“Enabled”,continuetothenextstep.

e. PressUporDownuntilyoureachthe“CtlNetworkMode”screenshowninFigure4.

f. Ifthetextonthesecondlinesaysanythingotherthan“Client(StaticIP)”,pressRighttoeditthe

setting.PressUpuntilthesecondlinesays“Client(StaticIP)”andthenpressRighttocommitthe

change.Ifthetextalreadysays“Client(StaticIP)”,continueontothenextstep.

g. PressUporDownuntilyoureachthe“CtlIPAddress”screenshowninFigure5.

h. PressRighttoedittheIPaddress.Youcanuseakeyboardthatyou’veattachedtotheUSB2.0

portsonthe“ControlInterface”sideoftheDittoDXtoenterthestaticIPaddressyournetwork

administratorgaveyou.

Ifyoudonothaveakeyboard,pressRightandLefttoscrollthecursorrightandleft,andpressUp

orDowntoincreaseordecreasethenumberhighlightedbythecursor.

Whenyouhavenished,pressRight tocommitthechanges.

f. TypetheIPaddressshownintoyourwebbrowser.

g. Logintothebrowserinterface(thedefaultusernameandpasswordfortheadministratoraccountare

both“admin”).

CRUrecommendsthatyouchangetheadminaccountpasswordandcreateuseraccountsforindividual

usersasbestdatamanagementpractices.

Youarenowreadytousethebrowserinterfacetoconguresettingsandpreview,image,orcloneattached

disks.

3.1.2 Accessing Via Direct Connection to Your Computer

a. PluganEthernetcableintotheEthernetportonthe“ControlInterface”sideoftheDittoDXForensic

FieldStation.

b. ConnecttheotherendoftheEthernetcabletoyourcomputer’sEthernetport.

ThecontrolEthernetportcanbeconguredtoactasaserver.AttachingaDittoDXForensicFieldStation

actingasaservertoanexistingnetworkthroughthecontrolEthernetportwillcausenetworkconicts.

ThereforeitisimportanttoattachtheDittoDXForensicFieldStationdirectlytoyourcomputerinstead.

TochangethissettingsothattheDittoDXForensicFieldStationnolongeractsasaserver,seeSection

5.2.3.

NOTE

STOP!

Protecting Your Digital Assets

Ditto DX Forensic FieldStation User Manual

c. Connect the power cable tothe rear of the Ditto DX Forensic FieldStationand to the providedAC

adapter.

d. TurnontheDittoDXForensicFieldStation’spowerusingtheswitchontherearpanel.(0=off,1=on)

e. PresstheDownnavigationbuttonontheDittoDXForensicFieldStationuntilyoureachthe“Settings”

menu(seeFigure1).ThenpresstheRight navigationbuttontoviewtheSettings.

f. PressUporDownuntilyoureachthe“CtlNetworkSettings”screenshowninFigure2andpress

Right.

g. PressUporDownuntilyoureachthe“CtlNetwork”screenshowninFigure3.

h. Ifthetextonthesecondlinesays“Disabled”,presstheRightbuttontoeditthesetting.PressUponce

andthenRighttocommitthechange.Ifthetextsays“Enabled”,continuetothenextstep.

i. PressUporDownuntilyoureachthe“CtlNetworkMode”screenshowninFigure4.

j. Ifthetextonthesecondlinesaysanythingotherthan“Server”,pressRighttoeditthesetting.Press

Upuntilthesecondlinesays“Server”andthenpressRighttocommitthechange.Ifthetextalready

says“Server,continueontothenextstep.

k. PressUporDownuntilyoureachthe“CtlIPAddress”screenshowninFigure5.

l. ThedefaultIPaddressforthecontrolEthernetportis10.10.0.1.Ifyouwishtochangetheaddress,

pressRighttodoso.OtherwiseproceedtoStepN.

m. Youcanuseakeyboardthatyou’veattachedtotheUSB2.0portsonthe“ControlInterface”sideof

theDittoDXtoenterthestaticIPaddressyournetworkadministratorgaveyou.

Ifyoudonothaveakeyboard,pressRightandLefttoscrollthecursorrightandleft,andpressUpor

Downtoincreaseordecreasethenumberhighlightedbythecursor.

Whenyouhavenished,pressRight tocommitthechanges.

n. TypetheDittoDXForensicFieldStation’scontrolIPaddressintoyourwebbrowser.

o. Logintothebrowserinterface(thedefaultusernameandpasswordfortheadministratoraccountare

both“admin”).

CRUrecommendsthatyouchangetheadminaccountpasswordandcreateuseraccountsforindividual

usersasbestdatamanagementpractices.

Youarenowreadytousethebrowserinterfacetoconguresettingsandpreview,image,orcloneattached

disks.

3.2 ICONS USED IN THE BROWSER INTERFACE

Thebrowserinterfaceusesseveraliconsthatmaybeclickedontoperformcertainactions.

ICON ACTION

Information

Opensawindowwithabriefdescriptionofthesettingtheinformationiconappearsnext

to.

Refresh

Refreshestheeldthattheiconappearsnexttoinordertogiveupdatedinformation.

Moreiconsaredetailedonthenextpage.

NOTE

Protecting Your Digital Assets

Ditto DX Forensic FieldStation User Manual

Icons Used in the Browser Interface, continued...

ICON ACTION

Reset

LoadsthedefaultsforthesettingthattheRefreshiconappearsnextto.

Add

Addsauserdenedeldtoalistofitems.

Remove

Removesauserdenedeldfromalistofitems.

3.3 USER ACCOUNTS

The Ditto DX ForensicFieldStation employsa user account system to control access to its features.The

“Login”screenpresentsyouwiththeabilitytologinthroughhttp,oryoucanclicktheSecure Login (HTTPS)

linktologinsecurely.Acceptthecerticateand/orcontinuetothewebsite,evenifyourbrowsertellsyouit

doesnotrecognizeit.

ThedefaultusernameandpasswordfortheAdministratoraccountareboth“admin”.CRUrecommendsthat

youchangetheadminaccountpasswordandcreateuseraccountsforindividualusersasbestdatamanage-

mentpractices.

ClickontheLog Out buttonatthetoprightofthebrowserinterfacetologout.

4 HOME SCREEN

The“Home”screeniswhereyouwillperformmostofyouroperationswiththeDittoDXForensicFieldStation,

andisthedefaultscreentoloaduponloggingintothebrowserinterface.ClickontheHome tabtoaccessthe

“Home”sceenfromanyotherareaofthebrowserinterface.

Figure 6. The“Home”screen.

Protecting Your Digital Assets

Ditto DX Forensic FieldStation User Manual

4.1 ACTION

The“Action”panelletsyoustart,abort,anddocumentthefollowingactions.The“Start”buttonbeginsthe

action.The“Abort”buttonstopstheactioninprogress.ClicktheComment buttontowriteanotethatwill

beappendedtothelog.ClicktheConﬁgure buttontomodifythedefaultsettingsforeachaction,whichcan

alsobemodiedonthe“Congure”screen(SeeSection5).

4.1.1 Clone Source Disk

TheDittoDXForensicFieldStationmakesanexactduplicateofthesourcediskononeortwodestination

disks.

Whilecloningthesourcedisk,theDittoDXForensicFieldStationcanalsohashthesourcediskusing

theMD5,SHA-1,SHA-256,MD5&SHA-1,orMD5&SHA-256algorithms.Selectthehashtypeunder

the“SystemSettings”panelonthe“Home”screen.SeeSection4.3.

Toclone,followthesesteps:

a. Usingthebrowserinterface,selectClone Source Diskfromthe“ActiontoPerform”drop-downbox.

b. Selectthesourcedisktoclonefromthe“Source”drop-downbox.

c. Selectthedestinationdiskfromthe“Destination”drop-downbox.

Destinationdisksdonothavetobethesamephysicalmediaasthesourcedisk,buteachmustbelarger

thanthesourcedisk.

d. ClicktheStart button.A“Completed”messageboxwillpopupwhentheactionhasnished.Click

onthemessagetocontinue.

Youcanincreasetheperformanceoftheoperationbyclickingoffofthebrowserinterfacewindowso

thatitisnotcontinuallyupdated.

Youcanviewtheresultsofthecloneactionbyscrollingdowntothe“SystemLog”panelonthe“Home”

screen.Findandclickonthelatestlink,whichwillbedenotedbyalenamewithadate/timestampformat:

“S_yyyymmddhhmmss”.Alternatively,youcanclickontheLogs button fromthetopmenubar.

4.1.2 Physical Image Source Disk

TheDittoDXForensicFieldStationcreatesanE01orDDimageofthesourcediskononeortwodestina-

tiondisks.

Whileimagingthesourcedisk,theDittoDXForensicFieldStationcanalsohashthesourcediskusing

theMD5,SHA-1,SHA-256,MD5&SHA-1,orMD5&SHA-256algorithms.Selectthehashtypeunder

the“SystemSettings”panelonthe“Home”screen.SeeSection4.3.

Figure 7. The“Action”sectiononthe“Home”screen,showingthe

optionsavailableforthe“CloneSourceDisk”action.

Figure 8.The“Action”sectiononthe“Home”screen,showingthe

optionsavailableforthe“PhysicalImageSourceDisk”action.

NOTE

Protecting Your Digital Assets

Ditto DX Forensic FieldStation User Manual

Forthefastestperformance,werecommendutilizinganNTFSlesystemforWindows,HFS+forMac,or

XFSforLinuxmachines.Tocreateaphysicalimage,followthesesteps:

a. Usingthebrowserinterface,selectPhysical Image Source Disk fromthe“ActiontoPerform”drop-

downbox.

b. Selectwhichtypeofphysicalimageyouwouldliketocreatefromthe“PhysicalImageType”drop-

downbox.Theimagetypes available are E01 or DD.Youcanmodify whichimage typeappearsby

defaultinthedrop-downboxonthe“Home”screen’s“SystemSettings”section(seeSection4.3),or

onthe“Congure”screen’s“System”tab(seeSection5.1).

c. Selectthesourcedisktoimagefromthe“Source”drop-downbox.

d. Selectwhichpartition(s)toimagefromthe“Partition”drop-downbox.ChooseAlltoimagetheentire

sourcedisk.

e. Selectthedestinationdiskfromthe“Destination”drop-downbox.

Toimagetotwodestinationdisksatthesametime,“DualDestinations”mustbeenabledinthe“Con-

gure”screen→“System”tab→“AdvancedSettings”section.Onceenabled,therstdestination

diskanditspartitioncanbechosenfromthe“Destination”and“Partition”drop-downboxes,andthe

seconddestinationanditspartitioncanbechosenfromthe“Destination2”and“Partition2”drop-

downboxes.

Destinationdisksdonothavetobethesamephysicalmediaasthesourcedisk,buteachmustbelarger

thanthesourcedisk.UsingE01compressioncanhelp.

f. ClicktheStart button.A“Completed”messageboxwillpopupwhentheactionhasnished.Click

onthemessagetocontinue.

Youcanincreasetheperformanceoftheoperationbyclickingoffofthebrowserinterfacewindowso

thatitisnotcontinuallyupdated.

Youcanviewtheresultsoftheimageactionbyscrollingdowntothe“SystemLog”panelonthe“Home”

screen.Findandclickonthelatestlink,whichwillbedenotedbyalenamewithadate/timestampformat:

“S_yyyymmddhhmmss”.Alternatively,youcanclickontheLogs buttonfromthetopmenubar.

4.1.3 Logical Image Source Disk

Logicalimagingallowsaninvestigatortoquicklyscanthecontentsofaharddiskandimageonlytheles

andfoldersrelevanttotheinvestigationintoanL01,ZIP,TAR,orLISTleformat.Datacanbeimagedto

oneortwodestinationdisks.Tocreatealogicalimage,followthesesteps:

a. SelectLogical Image Source Diskfromthe“ActiontoPerform”drop-downbox.

NOTE

Figure 9.The “Action” section on the“Home” screen, showing

theoptionsavailableforthe“LogicalImageSourceDisk”action.

Protecting Your Digital Assets

Ditto DX Forensic FieldStation User Manual

b. Selectwhichtypeoflogicalimageyouwouldliketocreatefromthe“LogicalImageType”drop-down

box.TheformatoptionsavailableareL01,TAR,ZIP,orLIST.(Youcanmodifywhichlogicalimagetype

appearsbydefaultinthedrop-downboxonthe“Congure”screen’s“System”tab.SeeSection5.1.)

“LogicalImageSourceDisk”actionscreateareportofdirectoriesandleschosenfromthesourcedisk

aswellastheirlesizesandanyerrormessagesencountered.Thisreportcanbeviewedfromwithin

thebrowserinterfaceandcanbeexportedasanExcelspreadsheet.SeeSection7.1.4.

c. SelecttheLogicalImageModefromthe“LogicalImageMode”drop-downbox.Seethelistoflogical

imagemodesattheendofthissubsectionforinformationonwhateachmodedoes.

d. Selectthesourcedisktoimagefromthe“Source”drop-downbox,thenchoosewhichpartition(s)to

imagefromthe“Partition”drop-downboxunderneaththe“Source”drop-downbox.Ifyouselect“All”,

partitionswillbeimagedsequentially.

e. Selectthedestinationdiskforthelogicalimagefromthe“Destination”drop-downbox,thenchoose

thedestinationdiskpartitionfromthe“Partition”drop-downboxunderneath.

f. IfyouchoseanyotherLogicalImageModebesides“ManualSelect”,clicktheStart buttonatthetop

ofActionsection.A“Completed”messageboxwillpopupwhentheactionhasnished.Clickonthe

messagetocontinue.

Ifyouchose“ManualSelect”,followthesesteps:

i. ClickonSelect Files & Dirs.Adialogboxwillopen.

ii. Usethenavigationtreetoselectthelesandfoldersyouwishtoimage(seeFigure10).

iii. ClicktheStart button atthebottomofthedialogbox.A“Completed”messageboxwillpopup

whentheactionhasnished.Clickonthemessagetocontinue.

You can view the results of the logical image action by scrolling down to the“SystemLog”panel on

the“Home”screen.Findandclickonthelatestlink,whichwillbedenotedbyalenamewithadate/

timestampformat:“S_yyyymmddhhmmss”.Alternatively,youcanclickontheLogs buttonfromthetop

menubar.

Figure 10.Thelenavigationtree.

NOTE

Protecting Your Digital Assets

Ditto DX Forensic FieldStation User Manual

Logical Image Modes

TheLogicalImageactioncanautomaticallysearchforlesthattthefollowingLogicalImageModes.

TheactionwillsearchforspecicleextensionsspeciedbytheLogicalImageMode.

• Manual Select: Enablesthe“SelectFiles&Dirs”buttonsothatyoucanmanuallyselectwhich

lestologicallyimage.

• All Files and Dirs: Imagesalllesanddirectories.

• All Except Windows: ImagesalllesanddirectoriesexceptfortheWindowsdirectory.

• All Except Windows and Programs: ImagesalllesanddirectoriesexceptfortheWindows,

ProgramFiles,ProgramFiles(x86),andProgramDatadirectories.

• All Users - Windows: ImagestheWindows“Users”directory.

• All Temporary - Windows: ImagestheWindows/TempandTempdirectories.

• All Except Swap and Hibernate:Imagesalllesanddirectoriesexceptlesnamedhiberl.sys,

pagele.sys,Win386.swp,and386part.par.

• All Media Files: Imagesall.avi,.jpeg,.jpg,.wav,and.movles,aswellasallleswithexten-

sionsbeginningin“.mp”(.mpeg,.mp4,.mp3,etc.)andallleswithextensionsbeginningin“.m4”

(.m4a,.m4v,etc.).

• All Ofﬁce Files: Imagesall.txtand.pdfles,aswellasallleswithextensionsbeginningin“.doc”,

“.xls”,“.ppt”(.doc,.docx,.xlsx,.pptx,etc.).

• All Financial Files:Imagesall.ifx,.ofx,.qfx,.qif,and.taxles.

Youmayalsoaddyourowncustomizedlogicalimagemodeprolestothisdrop-downlist.Todoso,

seeSection11.5.

4.1.4 Clone and Image Source Disk

Thisactionsimultaneouslycreatesacloneofthesourcediskononedestinationdiskandcreatesanimage

onaseconddestinationdisk.Two destination disks are required for this action.

Whilecloningandimagingthesourcedisk,theDittoDXForensicFieldStationcanalsohashthesource

diskusingtheMD5,SHA-1,SHA-256,MD5&SHA-1,orMD5&SHA-256algorithms.Selectthehash

typeunderthe“SystemSettings”panelonthe“Home”screen.SeeSection4.3.

Tosimultaneouslycreateacloneandaphysicalimageofthesourcedisk,followthesesteps:

a. SelectClone & Image Source Diskfromthe“ActiontoPerform”drop-downbox.

b. Selectthesourcedisktocloneandimagefromthe“Source”drop-downbox.

Figure 11. The“Action”sectiononthe“Home”screen,showing

theoptionsavailableforthe“Clone&ImageSourceDisk”action.

NOTE

Protecting Your Digital Assets

Ditto DX Forensic FieldStation User Manual

c. Selectthedestinationdiskfortheclonefromthe“CloneDestination”drop-downboxandthedestina-

tiondiskfortheimagefromthe“ImageDestination”drop-downbox.

Destinationdisksdonothavetobethesamephysicalmediaasthesourcedisk,buteachmustbelarger

thanthesourcedisk.

d. Selectthedestinationdiskpartitiononwhichtosavetheimagelefromthe“ImagePartition”drop-

downbox.

e. Selectwhichtypeofphysicalimageyouwouldliketocreatefromthe“PhysicalImageType”drop-

downbox.TheimagetypesavailableareE01orDD.(Youcanmodifywhichimagetypeappearsby

defaultinthedrop-downboxonthe“Congure”screen’s“System”tab.SeeSection5.1.)

f. ClicktheStart button.A“Completed”messageboxwillpopupwhentheactionhasnished.Click

onthemessagetocontinue.

Youcanviewtheresultsofthecloneandimageactionbyscrollingdowntothe“SystemLog”panelon

the“Home”screen.Findandclickonthelatestlinks,whichwillbedenotedbyalenamewithadate/

timestampformat:“S_yyyymmddhhmmss”.Alternatively,youcanclickontheLogs buttonfromthetop

menubar.

4.1.5 Restore Physical Image

Imagelesofanentirediskorpartitioncanberestoredtoanewdiskusingthisaction.Theimagele

mustbeineitherE01orDDformat.Imagelesofasinglepartitionwillberestoredasiftheoriginalhad

nopartitions.Thedestinationdiskmustalsobethesamesizeasorlargerthantheoriginal.

Torestoreaphysicalimage,followthesesteps:

a. SelectRestore Physical Imagefromthe“ActiontoPerform”drop-downbox.

b. From the “Source” drop-down box, select the source disk where the physical image you wish to

restoreresides.

c. Fromthe“Partition”drop-downbox,choosethepartitiononthesourcediskwherethephysicalimage

resides.

d. Selectthedestinationdiskfortheimagefromthe“Destination”drop-downbox.

Destinationdisksmustbelargerthanthesourceimage.

e. ClicktheSelect Image to Restorebutton,navigatetothephysicalimageyouwishtorestore,select

theimageletorestore.

Figure 12.The“Action”sectiononthe“Home”screen,showing

theoptionsavailableforthe“RestorePhysicalImage”action.

NOTE

Protecting Your Digital Assets

Ditto DX Forensic FieldStation User Manual

Iftheimagewasoriginallycreatedasasetofles,selecttherstleintheset.

f. ClicktheStart Restorebutton.TheDittoDXwillbeingrestoringtheimagetothedestinationdisk.

4.1.6 Erase Destination Disk

TheDittoDXForensicFieldStationerasesthedestinationdiskusingyourpreferredEraseMode.TheErase

ModesavailableareClearPartitionTable,QuickErase,LBA/OffsetPattern,CustomErase,SecureErase

Normal,SecureEraseEnhanced,DODClear,DODSanitize,NIST800-88Clear,andNIST800-88Purge.

Toeraseadisk,followthesesteps:

a. SelectErase Destination Diskfromthe“ActiontoPerform”drop-downbox.

b. SelecttheEraseModetousefromthe“EraseMode”drop-downbox.(Youcanmodifywhicherase

modeappearsbydefaultinthedrop-downboxonthe“Congure”screen’s“System”tab.SeeSec-

tion5.1.)

c. Selectthetargetdestinationdisk(s)fromthe“Target”drop-downbox.

d. ClicktheStart button.A“Completed”messageboxwillpopupwhentheactionhasnished.Click

onthemessagetocontinue.

Youcanviewtheresultsoftheerasureactionbyscrollingdowntothe“SystemLog”panelonthe“Home”

screen.Findandclickonthelatestlink,whichwillbedenotedbyalenamewithadate/timestampformat:

“S_yyyymmddhhmmss”.Alternatively,youcanclickontheLogs buttonfromthetopmenubar.

Format After Erase

YoucanconguretheDittoDXForensicFieldStationtoautomaticallyformatadiskafteryoueraseit.

ClickontheConﬁgure tabtogotothe“Congure”screen.ThenclickontheErase tabmakesurethat

“FormatAfterErase”ischeckedforeachoftheerasemodesonwhichyou’dliketoenablethissetting.

4.1.7 Hash Disk

TheDittoDXForensicFieldStationwillhashanysourceoradestinationdiskusingyourpreferredalgo-

rithm.HashvaluesaresavedintheSystemLog.TheavailablealgorithmsareMD5,SHA-1,SHA-256,MD5

&SHA-1,orMD5&SHA-256.

Tohashadisk,followthesesteps:

a. SelectHash Disk fromthe“ActiontoPerform”drop-downbox.

b. Selectyourpreferredhashalgorithm fromthe“HashType”drop-downbox.(You canmodifywhich

hashalgorithmappearsbydefaultinthedrop-downboxonthe“Congure”screen’s“System”tab.

SeeSection5.1.)

c. Selectthetargetdiskfromthe“Target”drop-downbox.

Figure 14. The“Action”sectiononthe“Home”screen,showing

theoptionsavailableforthe“HashDisk”action.

Figure 13.The“Action”sectiononthe“Home”screen,showing

theoptionsavailableforthe“EraseDestinationDisk”action.

NOTE

Protecting Your Digital Assets

Ditto DX Forensic FieldStation User Manual

d. Selectthepartitionyouwanttohashfromthe“Partition”drop-downbox.

e. ClicktheStart button.A“Completed”messageboxwillpopupwhentheactionhasnished.Click

onthemessagetocontinue.

Youcanviewtheresultsofthehashactionbyscrollingdowntothe“SystemLog”panelonthe“Home”

screen.Findandclickonthelatestlink,whichwillbedenotedbyalenamewithadate/timestampformat:

“S_yyyymmddhhmmss”.Alternatively,youcanclickontheLogs buttonfromthetopmenubar.

4.1.8 Snapshot Disk

TheDittoDXForensicFieldStationprovidesS.M.A.R.T.andhdparminformationforanysourceordestina-

tiondiskconnectedtoitself.Nocloneorimagerequestneedstobedone.

Tocreateasnapshotofadisk,followthesesteps:

a. SelectSnapshot Disk fromthe“ActiontoPerform”drop-downbox.

b. Selectthetargetdiskfromthe“Target”drop-downbox.

c. ClicktheStart button.A“Completed”messageboxwillpopupwhentheactionhasnished.Click

onthemessagetocontinue.

You can view the results of the snapshot action by scrolling down to the“SystemLog” panel on the

“Home”screen.Findandclickonthelatestlink,whichwillbedenotedbyalenamewithadate/time-

stampformat:“S_yyyymmddhhmmss”.Alternatively,youcanclickontheLogs buttonfromthetopmenu

bar.

Scrollto“eSATAExtendedDiskInfo”toseerecordeddata,includingS.M.A.R.T.andhdparminformation.

4.1.9 NetView Scan

NetViewisanetworktoolthatcanbeusedtodiscovermachinesonanetworkand

evenprobethemforspecicservicesthattheymayberunning.Thiscapabilitycan

helpaninvestigatorlocatephysicallyhiddencomputersorquicklydeterminewhether

amachineisactingasadatastoragedevicethattheDittoDXForensicFieldStation

canimage.

SeeSection11.1formoreinformationabouttheNetViewScanfeature.

4.2 INVESTIGATION INFO

TheInvestigationInfopanelgroupsrelatedinformationthatmayalsobeusedincreating

customdirectories andle names(see Section5.9).The“Hide”button allowsyouto

minimizethepanel.

ClicktheEdit buttontoenterinformationabouttheInvestigator,CaseNumber,EvidenceNumber,Descrip-

tion,Notes,Basedirectoryprex,andaBaselenameprexforanE01orDDimage.

Figure 15.The“Action”sectiononthe“Home”screen,

showingthe options available for the“NetviewScan”

action.

Figure 16. The“Action”sectiononthe“Home”screen,showing

theoptionsavailableforthe“SnapshotDisk”action.

Protecting Your Digital Assets

Ditto DX Forensic FieldStation User Manual

Eacheldislteredtoblocknon-printableASCIIcharacters.Anycharactersat thele

systemlevelthatmaynotbesafeforadirectorynameorlenamewillbelteredout

andreplacedwithanunderscore.OnlyprintableASCIIcharactersarecurrentlyallowed

fordirectoryandlenames.Multipleunderscoreswillalsobereducedtoasingleunder-

scorepernamingitem.

TheDittoDXForensicFieldStationwillgenerateanerrormessageifyouenter a non-

printableASCIIcharacterorifyourmessageexceedsthe58characterlimit.Additionally,

whenthenaldirectoryorlenamethatusesanyoftheseeldsiscreated,anotherlevel

oflteringisapplied.

Usingapostrophes(‘)inthenameeldswillcauseanerrorwhentheleorfolder

nameiscreated.TheyshouldnotbeusedintheInvestigationInfoelds.

4.2.1 User Deﬁned Fields

Clickonthegreen plus sign icontoopenthe“AddUserDenedField”window(see

Figure18).Youmayaddasmanyuserdenedeldsasyouwish.Eachuserdened

eldmusthaveatitle,XMLtag,andvalue.

ThetitleidentiesthevalueintheDittoDXForensicFieldStation’sbrowserandLCD

interfaces,andtheXMLtagonlyappearsinthecongurationandlogles.

Toremoveauserdenedeld,clickonthegreen minus sign icon.

4.3 SYSTEM SETTINGS

DisplaysthemostcommonlyusedcongurationsettingsoftheDittoDXForensicField-

Station.Thesesettingsareloadedasthedefaultsettingsfortheactionsyouperformin

the“Action”panel.The“Hide”buttonallowsyoutominimizethepanel.ClicktheEdit

buttontocustomizethesesettingsaswellasadditionaladvancedsettings.SeeSection

5.1fordetailsoneachoption.

4.4 CURRENT STATUS

Reportseitheras“Idle”ordisplaysinfoabouttheactionthattheDittoDXForensicField-

Stationiscurrentlyperforming.

4.5 DISKS

DisplaysinformationabouttheattatcheddisksthatarecurrentlyconnectedtotheDitto

DXForensicFieldStation.The“Hide”buttonallowsyoutominimizethepanel.Toseethe

availablespaceadiskhas,clickthegreen double arrow iconnextinthe“Used”column

header(seeFigure21).Thediskusagewillrefreshandgiveanupdatedamount.

The“Target Mode” button allows you to present the disks attached to the Ditto DX

ForensicFieldStationasiSCSIdisksonanetwork.Thisisusefulifyouwishtousethird

party dataacquisition tools against the disks without creating an image.The“Source

Network”and“SourceDestination”buttonsareusedformountingiSCSIdevicesaswell

asNFSandSMBsharestotheDittoDXForensicFieldStation.Formoreinformation,see

Section11.

Figure 20. The“Current Status” section, displayinga

thestatusofaPhysicalImageaction.

Figure 19.The“SystemSettings”section.

Figure 18. The“AddUserDenedField”window.

Figure 21. Clickingthegreendoublearrowicondisplays

andupdatesamountofspacecurrentlyusedandavail-

able.

STOP!

Figure 17. The“InvestigationInfo”section.

Protecting Your Digital Assets

Ditto DX Forensic FieldStation User Manual

4.5.1 Previewing and Browsing Disks

Tobrowseordownloaddiskdata,ortoselectlesandfoldersforlogicalimaging,clickonapartition’s

numberunderthedisk’s“Partition”columnandthenselectPreview(seeFigure23).Thisopensupale

explorerwindowwhereyoucannavigatethroughthelesandfoldersonthedisk.

Directory Toolbar and Right-Click Context Menu Items

ICON ACTION

CollapseFolderTree

Collapsestheentirefoldertreesothatonlythepreviewedpartition’s

folderisvisible.

Refresh

Refreshesthefoldercontentsinordertogiveupdatedinformation.

Up

Movesuptotheparentfolder.

Back

Movesbacktothepreviouslyviewedfolder.

Folders

Toggleswhetherfoldersaredisplayedinthecontentspanel.

SelectMode

Togglestheabilitytoselectindividuallesforlogicalimaging.

DetailView/ListView

ToggleswhethertheSize,Type,DateCreated,DateModed,andDate

Accessedcolumnsarevisible.

SizeFormat

Changeswhetherlesizesinthe“Size”columnaremeasuredas

bytesorasmegabytes,gigabytes,etc.

View

Openstheselectedle.ImagesandPDFleswillopeninapreview

window.Otherleswillopenadialogboxtodownloadtheletoyour

computer.

Download

Opensadialogboxtodownloadtheselectedletoyourcomputer.

Hash

Opensaninfowindowwiththeselectedle’sname,MD5hash,and

lesizeinbytes.

HexView

OpenstheleintheDittoDXForensicFieldStation’sbuilt-inhexadeci-

malviewer.

Figure 22. The“Disks”sectiononthe“Home”screen.

Protecting Your Digital Assets

Ditto DX Forensic FieldStation User Manual

Logically Image Data

Tologicallyimagedatausingthe“Preview”window,clickontheSelect Mode buttonandthencheck

theboxnextto eachleor folderyou wanttologicallyimage.When youarenished,clickon the

Stage buttoninthelowerrightcornerofthe“Preview”window.Youwillbetakenbacktothe“Home”

screen.Usethe“Action”controlpanelasdirectedinSection4.1.3.Whenyouclickon“SelectFiles&

Dirs”,youwillbeaskedtoconrmwhethertologicallyimagethelesandfoldersyouhaveselected,

ortoselectnewlesandfolders.

4.5.2 View Hexidecimal Data

Toviewadisk’shexidecimaldata,clickonthedisknameunderthe“Port”column

andthen select HexView. Toviewadisk partition’shexidecimaldata, clickonthe

partition’snumberunderthedisk’s“Partition”columnandthenselectHexView (see

Figure23).

4.5.3 View Snapshot Data

Toviewadisk’ssnapshotinformation,clickonthedisknameunderthe“Port”columnandthenselect

Snapshot.

4.6 SYSTEM LOG

ShowstheactionsthattheDittoDXForensicFieldStationhasperformed(seeFigure24).The“Hide”button

allowsyoutominimizethepanel.The“Comment”buttonallowsyoutowriteanotethatisappendedtothe

Systemlog.

IfthereisnoSDcardpresentintheSDcardslot,thispaneldisplaysthelogsthathavebeenstoredinvolatile

memorysincetheDittoDXForensicFieldStation’slastpowercycle.TheselogsaredeletedwhentheDitto

DXForensicFieldStationispowereddown.IfthereisanSDcardpresent,thispaneldisplaysallactionssaved

ontheSDCard.

Toviewthe logdetails ofaparticularaction,click onthelinkunderthe“Message”column.which willbe

denotedbyalenamewithadate/timestampformat:“S_yyyymmddhhmmss”.Alternatively,youcanclickon

theLogs buttonfromthetopmenubar.

Figure 24. The“SystemLogs”sectiononthe“Home”screen.

Figure 23. Drop-down menus for a disk (left) and a

disk’spartition(right).

Protecting Your Digital Assets

Ditto DX Forensic FieldStation User Manual

5 CONFIGURE SCREEN

The“Congure”screenallowsyoutomodifythewaytheDittoDXForensicFieldStationfunctionstosuityour

specicneeds.ClickontheConﬁgure tabtoaccessthe“Congure”screenfromthebrowserinterface.

5.1 SYSTEM

The“System”taballowsyoutoviewandcustomizethefollowingsettings.Thisinformationisalsodisplayed

inthe“SystemSettings”panelonthe“Home”screen.Whenyouarenished,clicktheCommit Changes

buttontosavethechanges.

5.1.1 Typical Settings

• Default Format: Thisisthedefaultlesystemthatwillbeusedtoformatdestinationdiskswhen

theyareusedinactionsthattheDittoDXForensicFieldStationperforms.

• Physical Image Type: Setsthedefaultphysicalimagetypeforallactionsthatcreateaphysicalimage.

• Logical Image Type: Setsthedefaultlogicalimagetypeforthe“LogicalImageSourceDisk”action.

• Verify Single: Determineswhetherindividualdestinationdisksarehashedandcomparedtothehash

valueofthesourcedisk.

• Verify Dual: Requiresthatthe“DualDestinations”optionbelowisenabled(seeSection5.1.2).Com-

paresthehashvalueofbothdestinationstothehashvalueofthesource.Youcanchoosetoverify

Destination1orDestination2individually,both,ornone.Destination1andDestination2areselected

fromthe“Action”sectionofthe“Home”screen.

• Verify Clone & Image: Determineswhetherclonedandimageddisksarehashedandcomparedto

thehashvalueofthesourcedisk’shashvalueduringa“Clone&ImageSourceDisk”action.Youcan

choosetoverifytheclone,theimage,both,ornone.

• Hash Type: Setsthedefaulthashalgorithmthatwillbeusedfordiskvericationandthe“HashDisk”

action.TheavailablealgorithmsareNone,MD5,SHA-1,SHA-256,MD5&SHA-1,orMD5&SHA-256.

Moresettingsareavailableonthenextpage.

Figure 25. The“Congure”screen,showingthe“System”tab.

Protecting Your Digital Assets

Ditto DX Forensic FieldStation User Manual

Typical Settings, continued...

• Erase Mode: Setsthedefaulterasemodethatwillbeusedforallactionsthatrequireerasingdisks.

• Logical Image Mode:SetsthedefaultLogicalImageModeforthe“LogicalImage Source Disk”

action.

• Stealth Mode: Turns off all LEDs and LCDs on the Ditto DX Forensic FieldStation.The physical

“StealthMode”Switchservesthesamepurpose(seeSection1.2).IfStealthModeisenabledfrom

thebrowserinterface,thephysicalswitchcannotoverrideit.

• LCD/LED Brightness:SetstherelativebrightnessoftheLCDsandLEDsonthefaceoftheDitto

DXForensicFieldStationonascaleof0to6.Settingavalueof“0”willturnoffallLCDsandLEDs

ontheunit.

• Audible Buzzer: Alerts the user to various actions that occur when using the Ditto DX Forensic

FieldStation.

5.1.2 Advanced Settings

• CPU Speed: SetsthespeedoftheDittoDXForensicFieldStation’sCPU.Theavailablesettingsfrom

fastesttoslowestareTurbo,Default,Economy,andPowerSaver.

• Dual Destinations: Enablessoftwaremirroringmodetowritethesamedatatotwodestinationsat

thesametime.

• Log Disk Info: DetermineswhetherS.M.A.R.T.andhdparmdiskinformationisloggedbeforerunning

anaction,afterrunninganaction,both,ornotatall.CRUrecommendsthatyoulogdiskinformation

beforeandafteranaction.

• HTML Logging: Logsarealways savedin.XMLformat.ThisoptioncausestheDittoDXForensic

FieldStationtosavelogsinHTMLformataswell.

• DiskView Logging: Logsanyactiontopreviewadiskoractionsperformedwhilepreviewingadisk

(i.e.startingornishingapreviewofadisk,startingornishingaHexViewaction).

• Lightbar Mode: EnablesordisablesthelightbaronthefaceoftheDittoDXForensicFieldStation.

TheavailablesettingsareOffandColor.

• Quick Start: Enablesthe“QuickStart”screenontheLCDthatappearsafteryoubootorrebootthe

DittoDXForensicFieldStation.Thesettingsforthismodemaybemodiedinthe“QuickStart”tab.

SeeSection5.10.

• Prompt Invest. Info: Opens a “Congure Investigation Info” window after the user has hit the

“Start”buttoninthe“Action”sectiononthe“Home”screen.Thisallowstheusertocustomizethe

Investigator, Case Number,Evidence Number, Description, Notes, Base Directory Name, and the

BaseFileNameinformationpriortoperformingtherequestedaction.

• LCD Prompt Case: Fiveoptionsmaybechosentomodifythecasenumberspeciedinthe“Investi-

gationInfo”sectionofthe“Home”screen.Thecasenumberisincludedinthelogfortherequested

action.“Disabled”leavesthecasenumberasitis.“Inc/Dec”allowsyoutomanuallyincrementthe

casenumberupordownusingthenavigationbuttonsonthefaceoftheDittoDXForensic Field-

Station. “AutoInc” automatically increments the case number, and“AutoInc/Pause” automatically

incrementsthecasenumber,butdisplaysaconrmationprompttheLCDscreenbeforebeginning

WiebeTech Ditto DX Forensic FieldStation User manual

Related papers

Other documents