 |
 |
My Dossier continues to ask if I want to wipe a brand new capture HDD. |
 |
|
This is a normal question that will be asked unless the new HDD is wiped by the Dossier. Using the Dossier to prepare (pre-wipe) a new Destination HDD will eliminate this screen from displaying while on site, thus speeding up the capture process. |
|
|
|
|
After installing a brand new destination drive in my Dossier and starting a capture, I received a message that the drive was not erased, is this normal? |
|
|
Even though new drives are usually blank, they still need to be wiped to guarantee that they do not contain any data.
The Dossier writes a signature to the destination drive during the wipe session. It is this signature that tells the Dossier that the destination or capture drive was previously wiped. Destination drives can be prepared ahead of time by wiping them with signature set to "YES". |
|
|
|
|
Where do I install the forensic boot CD when capturing a suspects Apple computer using TARGET Mode? |
|
|
Target mode causes the Apple Computer and its HDD to become visible via Firewire to the analysis PC. The Forensic Boot CD must be loaded into the analysis PC before or just after power-up (depending on CD-ROM drive type in the analysis PC). |
|
|
|
|
What is causing my capture speed to be slower than expected |
|
|
Capture speeds can be adversely impacted by several factors. Some of the common causes are; bad or dislodged cables, bad sectors located on drives and the overall health of your drives. Performing a Drive Defect Scan on S1, S2, D1 D2 or Flash may help eliminate speed related problems. If the destination drive's health is unknown and you wish to proceed quickly anyway it is recommended that HASH+V setting is selected prior to capture. |
|
|
|
|
Now that I have captured a suspect hard disk drive, how do I copy or pull the named report file? |
|
|
Press the USB/1394 icon and select USB or Firewire as the desired connection interface. Select System CF as the drive to be engaged. Press "Start" twice and Dossier will prompt "USB Link Up.." Attach the USB or Firewire cable (based on your previous selection) between your computer and the USB or Firewire port on the Dossier and the System CF will become visible under Windows-My Computer. Archive the named reports to your PC as necessary. Print reports using any standard text editor. |
|
|
|
|
Can Logicube products clone mSATA (also known as mini-SATA) solid state drives? |
|
|
These solid state drives use a PCI-e connector with a SATA interface. To clone these type drives you will need to purchase an off-the-shelf mSATA to SATA drive adapter, such as the M-Factors MF25-mSATA http://www.mfactors.com/products/mSATA%252dto%252dSATA-adapter.html |
|
|
|
|
Can I clone to/from drives larger than 80 Gigabytes? |
|
|
Yes. The firmware was designed to support drives up to at least 1TB, in some cases larger than 1TB drives are supported. Check with Logicube Technical Support department for specific information on your model. |
|
|
|
|
Can I make a bootable "clone" with the Dossier? |
|
|
While the Dossier was not designed to produce a bootable "clone", it will create a copy of the source drive with bit-for-bit accuracy. Whether or not the destination drive will boot depends upon many factors that include drive geometry, operating systems, and PC BIOS issues. |
|
|
|
|
Capturing data from a Western Digital Hard Disk Drive is not working. |
|
|
Most Western Digital drives require that the jumpers be removed for a capture to work. The exception to this statement is for the Western Digital "Xpert" series hard drives (an older manufactured version), where the jumper is set to the master position. |
|
|
|
|
Will DD image capture files have the same "odd sector" problem of the Linux operating system? |
|
|
Although DD Image capture files are formatted as "DD Linux" files, they do not utilize the Linux kernel. The Linux OS is unable to see the last sector of a drive that has an odd number of sectors. Some users have asked if this problem will prevent the last sector of an odd sector drive from being captured. The answer is no. |
|
|
|
|
What happens if a HASH mismatch occurs during a Mirror or DD capture with verification on? |
|
|
The capture session will immediately abort and this message will be displayed on the Dossier:
Error
Error Capturing Drive! Drive error
Either the speed setting is too high
Or a bad sector was found! |
|
|
|
|
What will happen if a drive cable makes intermittent contact during a capture? |
|
|
The capture session will immediately abort and an error message will be displayed on the Dossier display. |
|
|
|
|
If a verification mismatch occurs during a capture will the capture complete? |
|
|
No the capture session will immediately abort and display an error message on the Dossier indicating that an error has occurred. A Log file is not generated when a mismatch occurs. |
|
|
|
|
I'm trying to update my Dossier with the latest software but I cannot get my PC to communicate with the unit. |
|
|
Make sure that the PC is connected to either the USB or FireWire port. |
|
|
|
|
What is the maximum combined destination size available when Dossier's Spanning Mode is selected |
|
|
The current maximum combined destination size is 3TB when spanning is engaged on the Dossier. |
|
|
|
|
Can I use the Dossier to copy a non-Windows drive? |
|
|
Absolutely! Non-Windows drives can be duplicated using Capture Mode. This is a process that captures all data from the source drive to the destination drive at the sector level. |
|
|
|
|
When two drives are created from one source drive as a DD image with Disk+Verification turned ON how do I know both copies have been verified by Dossier to be exactly the same as the source? |
|
|
If at any time during the capture either of the two copies encounters a hash mismatch as part of the verification process, Dossier will terminate the capture before the log file can be created. If the capture completes successfully the SHA-256 and MD5 digests for S1 (Source 1) will be displayed on the Dossier and in the log file along with the message AN EXACT DD IMAGE FILE COPY OF S1 HAS BEEN ACHIEVED. |
|
|
|
|
How do I select between MD5 or SHA-256 Hash verification? |
|
|
Selection between MD5 and SHA-256 is not provided because Dossier is capable of generating both MD5 and SHA-256 hash verification algorithms simultaneously without any degradation in capture speed. |
|
|
|
|
By comparison my Dossier appears to be operating slower than other units. |
|
|
Make sure that your unit is using the latest software. Visit the support page on our website to view the latest software level and if necessary download the software for your system. |
|
|
