Over the years, E01 file format has become a popular format for forensic purposes due to its ability to store not only the physical or logical copy of the source drive, but also case and evidence details. E01 file can also contain both MD5 and SHA-1 hashes. And it is considered a good practice among forensic specialists to calculate both hashes while imaging the evidence so that they are included in the E01 file.

To view the hash calculated for an E01 file with Atola Insight Forensic, open the file by pressing the Plus icon in the port bar and then selecting E01 image files (*.E01) file extension in the drop-down menu to view existing files with this extension.

In the Home page look through the File History and click on the Imaging target link.

This will open an Imaging target report, at the bottom of which you will be able to see both hashes calculated during the imaging session.

You may leave this window open or save the report as a pdf file to compare the hash with the newly calculated one later.

Then go to Calculate Hash page in Hashing category of the left-side menu and select Linear in Hash method drop-down menu and MD5 and SHA-1 in Hash type drop-down menu.

Once the hashes have been calculated, you can make sure that the two sets of hashes are identical.

Atola Insight Forensic – All-in-one forensic data recovery tool. In-depth disk diagnostics, disk duplication and wiping, firmware and file recovery.

Please contact CDFS for more information
1300 55 33 24 | E-mail: contact@cdfs.com.au