Output Format; Hash/Verification Method - Logicube F-FALCON-SA User Manual

Logicube Forensic Falcon™ User's Manual

5.0.3.8 Output Format

When File to File mode is selected, Output Format will appear
on the top-right side of the Settings screen. Tap Output Format
and the following screen will appear

Directory Tree – All results will be written in a directory
tree format. All files will appear in the same directory
structure as found on the Source drive.

MFT Report – Results will list deleted files (if present)
that can potentially be restored or recovered.

LX01 Archive – Results will be in Encase's LX01 archive
format.

Zip Archive – Results will be in a Zip archive format.

5.0.3.9 Hash/Verification Method

This setting can be found in Drive to Drive, Drive to File, and File
to File and allows the user to set a hash and/or a verification
method.
Hash – Will hash the Source drive with the selected method.
There are two, three, or four hash algorithm options available,
depending on which Imaging mode or File Image Method is
selected:

None – No hash of the Source will be performed. This is
available only when using the following mode:
o Drive to Drive

SHA-1 – Uses the SHA-1 algorithm to hash the Source.
This is available in the following modes:
o Drive to Drive
IMAGING
:
54