Step-By-Step Instructions - Drive Hash Or Case Verify - Logicube Falcon-NEO User Manual

NEO will hash up to the LBA value of the smallest capacity drive. If drives with different
capacities need to be hashed, it is recommended to start one task per drive.
CASE VERIFY – This mode will hash cases/images created by the Falcon-NEO (DD, E01,
•
Ex01, DMG) for verification purposes. There are two settings for this mode:
Primary – This will verify the primary hash of the image. Use this if only on hash
-
value was selected when the case was imaged.
Both – This will verify both primary (SHA-1) and second hash (MD5) of the image.
-
Use this if SHA1+MD5 was used when the case was imaged.
3.2.1 Step-by-step instructions – Drive Hash or Case Verify
1.
2.
3.
4.
5.
6.
7.
Logicube Falcon -Neo User's Manual
®
Select Hash from the types of operation on the left side.
Tap the Modes icon and select the desired mode (Drive Hash or Case
Verify).
Tap the Drives icon and select the drive(s) to be hashed then tap the OK
icon.
Tap the Settings icon to choose the different settings based on the
Mode. Details for every setting can be found in
Change any of the optional settings (LBA settings or percentage of the
drive to be hashed) if needed.
Optional: Tap Case Info to set the Case/File Name, Case ID, Examiner,
Evidence ID, or Case Notes.
When finished, the status will show "COMPLETED". It is recommended to
tap Reset Task to reset the task, so the drive bays properly reset and not
show as being used or assigned for other tasks.
QUICK START
Section 5.2.3.
23