1. Manuals
  2. Brands
  3. CRU Manuals
  4. Other
  5. WiebeTech Ditto Shark
  6. User manual

CRU WiebeTech Ditto Shark User Manual

Forensic device for network data capture and analysis
Hide thumbs
Table of Contents

Advertisement

Quick Links

Download this manual
CRU
WiebeTech
®
User Manual
Features
•
Standalone product—operates without a PC or a Ditto Forensic FieldStation
•
Captures Internet and VOIP traffi c with virtually no packet loss*
•
Captures sustained 10/100 Mbps network traffi c and short burst gigabit network traffi c*
•
Filter and capture network traffi c to a tcpdump/Wireshark-compatible PCAP fi le
•
Optional live capture stream (rpcap) interface for Wireshark
•
Removable drive carrier for data storage
•
Fail-safe design continues passing through network traffi c if power is lost
•
Free fi rmware updates for registered users
*Packet loss is a function of the type and saturation level of traffi c on the tapped network
Ditto
Shark
®
®
Wiebetech Branding
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
Product Name:
2c85m76y
66c7m7y
Univers 73 Black Extended
PMS 711C
PMS 299C

Advertisement

Table of Contents
loading
Need help?

Need help?

Do you have a question about the WiebeTech Ditto Shark and is the answer not in the manual?

Questions and answers

Subscribe to Our Youtube Channel

Summary of Contents for CRU WiebeTech Ditto Shark

  • Page 1 WiebeTech Ditto Shark ® ® ® User Manual Features • Standalone product—operates without a PC or a Ditto Forensic FieldStation • Captures Internet and VOIP traffi c with virtually no packet loss* • Captures sustained 10/100 Mbps network traffi c and short burst gigabit network traffi c* •...

  • Page 2: Table Of Contents

    CRU Ditto Shark User Manual TABLE OF CONTENTS 1 General Information 6 Admin Screen 6.1 User Accounts 1.1 Package Contents 1.2 Identifying Parts 6.2 Permissions 1.3 LED Behavior 6.3 Adding a New User 1.4 Thermal Cooling 6.4 Editing an Existing User 1.5 How to Use the Ditto Shark...

  • Page 3: General Information

    RJ45 Gigabit 1.1 PACKAGE CONTENTS USB 2.0 Port Ethernet Connection The following list contains the items that are included in the complete confi guration for this device. Please contact CRU if any items are missing or damaged: Item Quantity Ditto Shark...

  • Page 4: How To Use The Ditto Shark

    Section 3) and a stealth switch that will turn off all external lights and enable nightvision display via Stealth Mode (see Section 10). NOTE CRU recommends that you switch the power off to the Ditto Shark when you add or remove a device from it in order to avoid disk damage and data corruption. 2 SETUP Settings a.
  • Page 5 CRU Ditto Shark User Manual • The Ditto Shark acts as a client on the network and you manu- Client (Static IP): Dst Network Mode: ally input all network parameters (e.g. IP address gateway, etc.). • Server: The Ditto Shark acts as the master DHCP server on the network and you Client (Static IP) manually input all network parameters.

  • Page 6: Browser Interface

    “admin”). NOTE CRU recommends that you change the admin account password and create user accounts for indi- vidual users as best data management practices. You are now ready to use the Browser Interface to confi gure settings and preview, image, or clone attached disks.

  • Page 7: Home Screen

    CRU Ditto Shark User Manual Figure 7. The “Home” screen. 4 HOME SCREEN The “Home” screen is where you will perform most of your operations with the Ditto Shark, and is the default screen to load upon logging into the Browser Interface. Click on the Home tab to access the “Home”...

  • Page 8: Live Network Capture

    CRU Ditto Shark User Manual c. Select “NetTap” from the “Interface” drop-down box. d. Select the media from the “Destination” drop-down box that you want Ditto Shark to save your captured data. e. Select the partition on the destination media you want to capture to from the “Partition” drop- down box.

  • Page 9: Simultaneous Pcap And Live Network Capture

    CRU Ditto Shark User Manual Simultaneous PCAP and Live Network Capture a. Using the Browser Interface, select Network Capture from the “Action to Perform” drop-down box. b. Select the network capture fi lter from the “Network Capture Filter” drop-down box or type in the ports you wish to capture in the text box directly below that using the syntax “port ## or ##”...

  • Page 10: Investigation Info

    CRU Ditto Shark User Manual b. Select the Erase Mode to use from the “Erase Mode” drop-down box. (You can modify which erase mode appears by default in the drop-down box on the “Confi gure” screen’s “System” tab. See Section 5.1.) c.

  • Page 11: System Settings

    CRU Ditto Shark User Manual The title identifies the value in the Ditto Shark’s browser and LCD interfaces, and the XML tag only appears in the configuration and log files. To remove a user defined field, click on the green minus sign icon.

  • Page 12: System Log

    CRU Ditto Shark User Manual 4.6 SYSTEM LOG Shows the actions that the Ditto Shark has performed (see Figure 16). The “Hide” button allows you to minimize the panel. The “Comment” button allows you to write a note that is appended to the System log.
  • Page 13 CRU Ditto Shark User Manual • Sets the default format for the “Erase Destination Disk” action. The available Default Format: format types are ext2, ext3, ext4, XFS, HFS+, FAT32, and NTFS. • Hash Type: Sets the default hash algorithm that will be used for PCAP file verification. The avail- able algorithms are None, MD5, and SHA-1.

  • Page 14: Network

    • Determines whether S.M.A.R.T. and hdparm disk information is logged before Log Disk Info: running an action, after running an action, both, or not at all. CRU recommends that you log disk information before and after an action. • HTML Logging: Logs are always saved in XML format.
  • Page 15 CRU Ditto Shark User Manual 5.2.2 Destination Network The “Destination Network” section displays the destination Ethernet port’s MAC Address as well as its network mode. You can enable or disable it using the check box. To set the network mode, choose either “Server”, “Client (DHCP)”, or “Client (Static IP)” from the drop-down box.
  • Page 16 CRU Ditto Shark User Manual Choose “Client Mode” to connect to an existing wifi network or “Hot Spot Mode” to make the Ditto Shark into a wifi hot spot. Client Mode Check “Status: Auto Start” if you want the Ditto Shark to connect to the specified wireless network automatically.

  • Page 17: Erase

    CRU Ditto Shark User Manual Figure 19. The “Erase” tab on the “Confi gure” screen, showing the available erase modes and their customiz- able settings. 5.3 ERASE The Ditto Shark allows you to view and customize settings for how the Ditto Shark erases disks.
  • Page 18 CRU Ditto Shark User Manual • Allows you to capture up to the specified amount of bytes of each packet of data. Snap Size: • Dropped Pkt Log Interval: Allows you to specify the time interval in minutes of how often the Ditto Shark writes its accumulated dropped packet information to the Action log.

  • Page 19: Naming

    CRU Ditto Shark User Manual 5.5 NAMING The “Naming” tab allows you to customize how the Ditto Shark names directories and files during imaging actions. When you are finished, click the Commit Changes button to save the changes. As shown in Figure 21, the file directory used in network capture actions can be a name that contains up to six user-selectable fields, and the file name used in network capture actions can contain up to four user-selectable fields.

  • Page 20: Admin Screen

    CRU Ditto Shark User Manual 6 ADMIN SCREEN The “Admin” screen allows the administrator to manage user accounts and assign permis- sion levels for each user. Click on the Admin tab to access the “Admin” screen from the Browser Interface.

  • Page 21: Adding A New User

    CRU Ditto Shark User Manual • Controls the ability to delete log fi les from the “Logs” screen. Logs: • DiskView: Controls the ability to HexView and Snapshot media via the “Disks” panel on the “Home” screen. 6.3 ADDING A NEW USER...

  • Page 22: Utilities Screen

    CRU Ditto Shark User Manual Logs” dialog box will pop up. Name the log file and choose whether to save it in XML or HTML format. Then click the Submit button. The “Save As” dialog box will pop up. Choose where on your system to save the file, then click Save.

  • Page 23: Upgrade Log Messages

    CRU Ditto Shark User Manual • Opens a confirmation dialog to return the Ditto Shark to factory settings. Check the Factory Reset: Purge Ditto SD card log files box to remove all log files from the SD card in the unit. You can also use the Front Panel to perform a factory reset.

  • Page 24: Perform Action

    CRU Ditto Shark User Manual 9.2.2 Perform Action After you adjust settings to your specifications, you are ready to put the Ditto Shark to work. The “Per- form Action” screen lets you start or abort any of the Ditto Shark’s actions using the current settings.

  • Page 25: Settings

    CRU Ditto Shark User Manual Keyboard Commands, continued... COMMAND Backspace Deletes the character immediately behind the cursor. NumLock Forces the numbered arrow keys to type numbers when pressed. CapsLock Forces all letter keys to type capital letters. Tab/Shift+Tab/Page Up/ Page Down/Function/Alt/ Not handled.
  • Page 26 • Determines whether S.M.A.R.T. and hdparm disk information is logged before Log Disk Info: running an action, after running an action, both, or not at all. CRU recommends that you log disk information before and after an action. • HTML Logging: Logs are always saved in XML format.
  • Page 27 CRU Ditto Shark User Manual reached, the Ditto Shark will begin overwriting the oldest file on the disk for each new file that is created. Set this to ‘0’ to fill the disk until it reaches capacity. • NetCap Snap Size: Allows you to capture up to the specified amount of bytes of each packet of data.

  • Page 28: Disk Info

    CRU Ditto Shark User Manual 9.2.5 Disk Info Destination DataPort: The “Disk Info” screen (Figure 27) shows all available disks attached to either the Hitachi HT...232A7A384 source or destination ports. Ports are shown only if a disk is connected there. Press 320.1GB NTFS...
  • Page 29 CRU Ditto Shark User Manual f. Type in the port number of the target iSCSI volume into the “Port” text field if the number is dif- ferent than the default value of ‘3260’. If you don’t know the port number, leave it as the default value.

  • Page 30: Using Nfs And Smb (Samba) Shares

    CRU Ditto Shark User Manual k. If authentication is required to connect to the IQN, click the and input the Advanced... button appropriate credentials, including the user name, password, and domain. Otherwise, continue to the next step. Click the button. The IQN will now appear in the list below.

  • Page 31: Using And Configuring Network Capture Filters

    CRU Ditto Shark User Manual 11.2.2 Remove an NFS or SMB (Samba) Share a. On the “Home” Screen, click the Destination Network button at the bottom of the “Disks” panel. b. Click on the NFS tab tab, depending on the which type of share you are removing.

  • Page 32: Upgrading Firmware

    CRU Ditto Shark User Manual 11.3.2 Manual Filter Creation To manually create a network capture fi lter on an SD Card, you must manually create a DittoNetCap- Filter directory on your SDCard fi rst. Then you can add one or more network capture fi lter XML fi les to that directory.
  • Page 33 CRU Ditto Shark User Manual f. The Ditto Shark will download the file to itself. Once downloaded, it will ask you to confirm the upgrade. Click Continue. After the upgrade is finished, click OK. g. The LCD panel of the Ditto Shark will ask you to reboot. Press the...

  • Page 34: Technical Specifications

    Product Dimensions 5.63in W x 9.00in L x 1.62in H (143mm W x 229mm L x 41mm H) Your investment in CRU products is backed up by our free technical sup- Technical Support port for the lifetime of the product. Contact us through our website, www.
  • Page 35 CRU product or service, even if CRU has been advised of the possibility of such damages.

Table of Contents