Digital Data Analysis with DITTO DX Forensic

DITTO DX Forensic – Today, digital data recovery and forensic analysis processes are becoming increasingly complex and challenging due to the rapid proliferation of digital devices and the growing volume of data.

As a result, the effectiveness and reliability of these processes are of paramount importance.

Digital data recovery experts and forensic analysts need reliable and efficient tools to collect data from all types of digital devices. This is precisely where the DITTO DX Forensic device plays a critical role in digital data recovery and analysis.

This device makes data collection and analysis processes far more secure and efficient.

What Is DITTO DX Forensic?

More About DITTO DX Forensic

DITTO DX Forensic is a device developed to accelerate and improve the reliability of digital data recovery processes. With the features it provides, users can collect and analyze data more effectively.

DITTO DX Forensic is a portable device designed to facilitate digital data recovery and analysis operations. It is used by data recovery specialists, cybersecurity professionals, and forensic analysts to securely and effectively collect digital evidence.

DITTO DX Forensic accelerates digital data analysis processes while preserving data integrity, enabling the acquisition of evidence that can be used in forensic proceedings.

DITTO DX Forensic Box Contents

Features and Advantages of DITTO DX Forensic

1. Portability: Being a portable device, DITTO DX Forensic enables rapid response at field locations or incident scenes.
2. Multi-Media Support: The device is suitable for collecting data from a wide range of digital storage media, including computers, mobile devices, memory cards, USB drives, and more.
3. Data Integrity: DITTO DX Forensic preserves the integrity of data collection and analysis operations, preventing alteration of the original data.
4. The device’s user-friendly interface makes data recovery and analysis processes more efficient.
5. DITTO DX Forensic offers broad data storage support for collecting data from computers, mobile devices, memory cards, USB drives, hard disks, and other digital storage media, making it easier to gather and analyze data from various digital devices.
6. The device’s powerful hardware performs high-speed data copying and imaging operations, contributing to the efficient completion of digital data recovery processes.
7. DITTO DX Forensic can detect data deletion operations performed on digital devices — a capability that plays an important role in determining whether forensic evidence has been destroyed.
8. The device analyzes different file systems, helping to understand data organization and file relationships.
9. DITTO DX Forensic facilitates text-based searches within large volumes of data to locate specific keywords or phrases.

LightBar Status Indicator by Color:

Installation and Usage

The control interface section of the Ditto DX Forensic FieldStation features a power button, a power input for the 12V power supply, two USB ports for a keyboard or Wi-Fi adapter, an RJ45 Ethernet port for accessing the Ditto DX browser interface (Section 3), and a stealth button that turns off all lights and activates night-vision mode (Section 10).

Suspect drives or devices are connected to the Ditto DX’s source input section. All source inputs are write-protected to prevent any modifications. The source input section includes a USB 3.0 port, one RJ45 Ethernet port, an IDE/PATA disk port, one eSATA port for SATA drives or eSATA devices, and a PCIe x4 port for the Ditto DX adapter kit or SAS/FireWire expansion modules.

The Ditto DX’s destination output section is used for acquired data. Destination output connections include two USB 3.0 ports, an RJ45 Ethernet port, two eSATA ports for SATA or eSATA devices, and one PCIe x4 port for the adapter kit and expansion modules mentioned above.

NOTE: It is recommended to power off the device before connecting another device to the Ditto DX Forensic FieldStation. Failure to do so may cause damage to the Ditto DX device or data loss and damage to connected drives.

Browser Interface

The Ditto DX can be operated from the front panel or via the browser interface.

Accessing Over a Network:

1. Connect an Ethernet cable to the RJ45 port on the Ditto DX Control Interface side.
2. Connect the other end of the cable to a router or hub.
3. Connect the power cable.
4. Power on the Ditto DX using the power button on the back (0 = off, 1 = on).
5. If you have previously configured the Ditto DX and know its IP address, skip to the end of this section. If not, use one of the two methods below.

Configuring Using DHCP:

1. Use the down arrow to navigate to the Settings section, then press right to continue.
2. Use the up/down arrows to find “Ctl Network Settings.”
3. Use the up/down arrows to find “Ctl Network.”
4. If it shows “Disabled,” press right to change it. Press up then right to change the setting. Once it shows “Enabled,” proceed to the next step.
5. Use the up/down arrows to find “Ctl Network Mode.”
6. If the second line does not show “Client (DHCP),” change the setting to “Client (DHCP).”
7. Navigate to “Ctl IP Address.”
8. After setting a static IP on your computer using the provided IP address, enter that IP in the browser.

Configuring Using a Static IP:

1. Use the down arrow to navigate to the Settings section, then press right to continue.
2. Use the up/down arrows to find “Ctl Network Settings.”
3. Use the up/down arrows to find “Ctl Network.”
4. If it shows “Disabled,” press right to change it. Press up then right to change the setting. Once it shows “Enabled,” proceed to the next step.
5. Use the up/down arrows to find “Ctl Network Mode.”
6. If the second line does not show “Client (Static IP),” change the setting. Save the setting and proceed.
7. Navigate to “Ctl IP Address.”
8. The IP address can be changed from this screen. You can enter an IP address by connecting a keyboard to the USB 2.0 ports on the Control Interface side. If no keyboard is available, use the left and right arrow buttons to select numbers and enter the IP address. When done, press the right arrow to save the setting.
9. After setting a static IP on your computer using the provided IP address, enter that IP in the browser.

Main Screen

The main screen is the first screen seen after logging in, and most operations are performed from here.

ACTION

DITTO DX Forensic offers a range of features that make users’ workflows more efficient. These features simplify the collection and analysis of digital evidence.

The “Action” panel is where all operations such as starting or cancelling a clone are performed. Clicking the “Comment” button allows you to add a note to the log. The “Configure” [0] button is used to change default settings for each operation. The same action can also be performed from the “CONFIGURE” [1] section in the top panel.

Clone Source Disk

Ditto DX can write an exact copy of the source disk to one or two destination drives. Additionally, during the cloning process, Ditto DX can calculate the hash of the source disk using MD5, SHA-1, SHA-256, or MD5 & SHA-256 algorithms.

Follow these steps to clone a disk:

1. In the browser interface, select “Clone Source Disk” from the dropdown menu next to Action To Perform.
2. Select the source and destination drives.

The source and destination drives do not need to be of the same type, but the destination disk must have greater capacity than the source disk. Cloning results can be viewed in the “System Log” section at the bottom of the main screen or by clicking the “LOGS” button in the top panel.

Physical Image Source Disk

The Ditto DX Forensic FieldStation can write an E01 or DD format image of the source disk to one or two destination drives. NOTE: Ditto DX can also calculate the hash of the source disk using MD5, SHA-1, SHA-256, or MD5 & SHA-256 algorithms during imaging.

For best performance, NTFS is recommended for Windows, HFS+ for Mac, and XFS for Linux.

1. In the browser interface, select “Physical Image Source Disk” from the dropdown menu next to Action To Perform.
2. From the “Physical Image Type” dropdown menu, select the desired image format. Two formats are available: E01 and DD. The default image type can be changed via the System Settings Configure button [0] at the bottom of the main screen, or under the CONFIGURE button in the top panel under the System page.
3. Select the source drive.
4. From the Partition dropdown menu, select which disk partitions to image. The “All” option images the entire source disk.
5. Select the destination drive. To image to two destinations simultaneously, the “Dual Destinations” option must be enabled. To enable it, go to the Configure panel > System section > Advanced Settings. Once enabled, the first destination is configured using the Destination and Partition dropdowns, and the second is configured using Destination 2 and Partition 2.
6. Click the Start button to begin the operation. A pop-up window with the message “Completed” will appear when finished.

The source and destination drives do not need to be of the same type, but the destination disk must have greater capacity than the source. Using E01 Compression can help with this. Imaging results can be viewed in the “System Log” section at the bottom of the main screen or via the “LOGS” button in the top panel.

Logical Image Source Disk

A logical image allows an investigator to quickly examine the contents of a hard drive and access only the files relevant to the investigation, in formats such as L01, ZIP, TAR, or LIST. Follow these steps to capture a logical image:

1. In the browser interface, select “Logical Image Source Disk” from the dropdown menu next to Action To Perform.
2. From the “Logical Image Type” dropdown menu, select the desired type. Four types are available: L01, TAR, ZIP, and LIST. The default image type can be changed in the System tab of the Configure screen.

The “Logical Image Source Disk” operation generates a report of selected folders and files from the source disk, along with file sizes and any errors encountered during the process.

3. Select the Logical Image Mode from the dropdown menu. Available modes are described at the end of this section.
4. Select the source drive from the “Source” dropdown menu. Then, select which partitions to image from the “Partition” dropdown under the source. If “All” is selected, the entire disk is imaged.
5. Select the destination drive from the “Destination” dropdown. Then select the target partition from the “Partition” dropdown.
6. The Logical Image Mode defaults to “Manual Select.” Once you change this value, the Start button becomes active. When the operation completes, a pop-up window with the message “Completed” will appear.

If “Manual Select” is chosen, follow these steps:

• Click the “Select Files & Dirs” button; a dialog screen will appear.
• From the dialog, select the files and folders you want to image.
• Click the Start button. When the operation completes, a pop-up with the message “Completed” will appear.

Imaging results can be viewed in the “System Log” section at the bottom of the main screen or via the “LOGS” button in the top panel.

Logical Image Modes

Manual Select: Activates the “Select Files & Dirs” button, allowing you to manually select the files for the logical image.

All Files and Dirs: Images all files and folders.

All Except Windows: Images all files and folders except the Windows folder.

All Except Windows and Programs: Images all files and folders except the Windows, Program Files, Program Files (x86), and ProgramData folders.

All Users Windows: Images all Windows “Users” folders.

All Temporary Windows: Images the Windows/Temp and Temp folders.

All Except Swap and Hibernate: Images all files and folders except hiberfil.sys, pagefile.sys, Win386.swp, and 386part.par.

All Media Files: Images all .avi, .jpeg, .jpg, .wav, and .mov files, all files with extensions starting with “.mp” (.mpeg, .mp4, .mp3, etc.), and all files with extensions starting with “.m4” (.m4a, .m4v, etc.).

All Office Files: Images all .txt and .pdf files, and all files with extensions starting with “.doc,” “.xls,” and “.ppt” (.doc, .docx, .xlsx, .pptx, etc.).

All Financial Files: Images all .ifx, .ofx, .qfx, .qif, and .tax files.

NOTE: You can add a customized Logical Image Mode profile to the dropdown menu.

Difference Between Physical and Logical Images

A Physical Image is a complete copy of the device — the most comprehensive image available. Physical forensic images also capture deleted partitions and file fragments, and provide access to encrypted and deleted data. The advantage is full access to device files and logs; the disadvantage is that it requires greater resources.

A Logical Image, on the other hand, captures all files visible to the user on a disk. It does not recover deleted files and cannot retrieve data from deleted sections of the device. It also does not collect file fragments. The advantage is that it requires fewer resources; the disadvantage is that it provides no information about deleted files.

File fragmentation refers to a file being scattered across a hard drive rather than stored in a single contiguous location. Fragmentation occurs when information is deleted from a hard drive, leaving small gaps that are filled with new data as it is saved. If the gaps are too small for new data, the remaining portion is stored in other available spaces.

Clone and Image Source Disk

This operation simultaneously clones the source disk to the first destination drive and writes a disk image to the second destination drive. (This operation requires two destination drives.) Ditto DX can also calculate the hash of the source disk during this process using MD5, SHA-1, SHA-256, or MD5 & SHA-256 algorithms. The hash type can be selected from the “System Settings” panel on the main screen.

Follow these steps to clone and physically image simultaneously:

1. In the browser interface, select “Clone & Image Source Disk” from the dropdown menu next to Action To Perform.
2. Select the source drive.
3. Select the clone destination drive from “Clone Destination,” then select the image destination drive from “Image Destination.”
4. Use “Image Partition” to specify the destination disk partition where the image file will be saved under “Destination Disk Partition.”
5. From the “Physical Image Type” dropdown, select the desired format (E01 or DD). The default can be changed via the Configure button in System Settings.
6. Click the Start button. A pop-up with the message “Completed” will appear when finished.

Results can be viewed in the “System Log” panel at the bottom of the main screen or via the “LOGS” button in the top panel.

Restore Physical Image

An image taken from one disk can be restored to another. The image file must be in DD or E01 format. The destination disk must be the same size as or larger than the source disk.

Follow these steps to restore a disk:

1. In the browser interface, select “Restore Physical Image” from the dropdown menu next to Action To Perform.
2. From the Source dropdown, select the source drive containing the physical image.
3. From the Partition dropdown, select the partition on the source drive that contains the physical image.
4. From the Destination dropdown, select the destination drive.

The destination disk must be larger than the source disk.

• Click Select Image To Restore and choose the image file to restore. If the image consists of multiple files, select the first file in the set.
• Press the Start button. Ditto DX will begin the restore operation.

Erase Destination Disk

Ditto DX Forensic FieldStation can erase a drive connected to the destination section according to the selected erase mode. The available erase modes are:

1. Clear Partition Table
2. Quick Erase
3. LBA/Offset Pattern
4. Custom Erase
5. Secure Erase Normal
6. Secure Erase Enhanced
7. DOD Clear
8. DOD Sanitize
9. NIST800-88 Clear
10. NIST800-88 Purge

Follow these steps to erase a drive:

1. In the browser interface, select “Erase Destination Disk” from the dropdown menu next to Action To Perform.
2. From the Erase Mode dropdown, select the erase mode. The default can be changed in the Configure screen under the System tab.
3. From the Target dropdown, select the destination drive.
4. Click the Start button. A pop-up with “Completed” will appear when finished.
5. The erase operation results can be viewed in the System Log panel on the main screen.

Format After Erase

Ditto DX can be set to format the drive after an erase operation. Go to the Erase tab in the Configure screen and check the format after erase option for each erase mode.

Hash Disk

Ditto DX Forensic FieldStation can calculate the hash of any drive connected to either the source or destination side. Hash values are recorded in the system log. Available hash formats are MD5, SHA-1, SHA-256, MD5&SHA-1, and MD5&SHA-256.

Follow these steps to hash a drive:

1. In the browser interface, select “Hash Disk” from the dropdown menu next to Action To Perform.
2. From the “Hash Type” dropdown, select the desired hash algorithm. The default can be changed in the Configure screen under the System tab.
3. Select the drive to hash from the Target dropdown.
4. Optionally, select the partition to hash from the Partition dropdown. Use All to hash the entire drive.
5. Click the Start button. A pop-up with “Completed” will appear when finished.

When the operation completes, the hash value can be viewed in the System Log panel on the main screen.

Snapshot Disk

Ditto DX Forensic FieldStation provides S.M.A.R.T. and hdparm information about any drive connected to either the source or destination side, without requiring a clone or imaging operation.

Follow these steps to take a snapshot of a drive:

1. In the browser interface, select “Snapshot Disk” from the dropdown menu next to Action To Perform.
2. Select the target drive from the Target dropdown.
3. Click the Start button. A pop-up with “Completed” will appear when finished.

View the results in the System Log panel on the main screen.

NetView Scan

NetView is a network tool that discovers machines on a network and scans for specific services running on those machines. This feature helps investigators locate physically hidden computers or determine whether any machine is being used as a data storage device that can be imaged by the Ditto DX.

Investigation Info

The Investigation Info panel groups related pieces of information that can be used to create specific directories or files. Clicking the Edit button allows modification of the investigator, case number, evidence number, description, notes, base directory name, and base file name for E01 or DD images. Invalid characters are filtered out.

User Defined Fields

Click the green plus button to open the “Add User Defined Field” window. You can add as many fields as needed. Each added field requires a title, XML tag, and value. The title defines the name displayed in the Ditto DX Forensic FieldStation browser interface. The XML tag is visible only in configuration and log files. To delete user-defined fields, click the green minus button.

System Settings

The most commonly used configuration settings are displayed here. These are the default settings used for operations performed in the “Action” panel. Click the Configure button to change these settings.

Current Status

Displays the progress percentage of the current operation or the availability status.

Disks

Displays connected drives. Click the green button to view drive usage rates. The Target mode button allows you to present devices connected to Ditto DX as iSCSI disks over a network. iSCSI (Internet Small Computer System Interface) is a method for connecting network data storage devices to each other over TCP/IP, enabling disks in a storage device to be used across networked computers as if they were local virtual disks.

The “Source Network” and “Destination Network” buttons are used to connect iSCSI devices and to mount NFS and SMB shares. For more information, refer to Section 11.

Previewing and Browsing Disks

To view and download disk contents, or to select files and folders for a logical image, click the partition number. A window will appear where you can browse files and folders.

View Hexadecimal Data

To view a drive’s data in hex format, click the drive name under the Port column, then select HexView. To view a partition’s hex data, click the partition number and select HexView.

View Snapshot Data

To view snapshot information for a drive, click the drive name under the Port column and select Snapshot.

System Log

Displays operations performed by Ditto DX. Click the Comment button to add entries to the System Log. If no SD card is inserted, all logs captured in temporary memory since the last power-on are listed. These logs are deleted when the Ditto DX is powered off. If an SD card is inserted, this panel lists all operations recorded on the card. To view the log details of a specific operation, click the links under the Message column. Links will be in the format “S_yyyymmddhhmmss” — for example: S_20140819145247.

Configure Screen

The Configure screen allows you to adjust Ditto DX functions to suit your needs. You can access this screen by pressing the Configure button next to the Home button.

System

The System tab allows you to change the settings listed below. This information is also displayed in the System Settings panel on the main screen.

Typical Settings

• Default Format: The disk format used for formatting when a destination disk format operation completes.
• Physical Image Type: The default physical image type for all operations that create physical images.
• Logical Image Type: The default logical image type for the “Logical Image Source Disk” operation.
• Verify Single: Enables or disables hash acquisition from the destination disk and comparison with the hash taken from the source disk.
• Verify Dual: Requires the “Dual Destinations” feature to be active. Enables or disables comparison of hash values from two destination drives with the source hash. Four options are available: Destination 1 only, Destination 2 only, Both, or Off. If Destination 1 only is selected, hash values of the source and destination 1 are compared.
• Verify Clone & Image: Enables or disables hash comparison between source and destination for the “Clone & Image Source Disk” operation. Four options: Verify clone, Verify image, Verify both, or None.
• Hash Type: Allows selection of the default hash algorithm for disk verification and the “Hash Disk” operation.
• Erase Mode: Sets the default erase mode used for all operations that require erasing disks.
• Logical Image Mode: Allows selection of the default logical image mode for the “Logical Image Source Disk” operation.
• Stealth Mode: Turns off the Ditto DX’s LEDs and LCD. The “Stealth” button on the Control Interface can be used for the same purpose.
• LCD/LED Brightness: Adjusts the brightness of the LCD and LEDs on a scale of 0–6. Setting this to 0 turns off all lights.
• Audible Buzzer: Alerts the user to events while operating the Ditto DX Forensic FieldStation.

Advanced Settings

• CPU Speed: Adjusts the CPU speed of Ditto DX. Available settings from fastest to slowest: Turbo, Default, Economy, and Power Saver.
• Dual Destinations: Enables software mirroring mode to write the same data to two destinations simultaneously.
• Log Disk Info: Configures when S.M.A.R.T. and hdparm disk information is logged: Before operation, After operation, Both, or None. CRU recommends logging both before and after.
• HTML Logging: Logs are always saved in XML format. This option additionally saves logs in HTML format.
• DiskView Logging: Logs any action taken to preview a disk or performed while previewing a disk (e.g., starting/stopping a disk preview, starting/stopping a HexView action).
• Lightbar Mode: Enables or disables the light bar on the front of the Ditto DX Forensic FieldStation. Available settings: Off and Color.
• Quick Start: Enables the “Quick Start” screen displayed on the LCD after starting the Ditto DX Forensic FieldStation. Settings for this mode can be changed in the “Quick Start” tab. See Section 5.10.
• Prompt Invest. Info: Opens the “Configure Investigation Info” window after the user presses the “Start” button in the “Action” section of the main screen, allowing customization of Investigator, Case Number, Evidence Number, Description, Notes, Base Directory Name, and Base File Name before performing the action.
• LCD Prompt Case: Provides five options for changing the case number specified in the “Investigation Info” section of the main screen. “Disabled” leaves the case number as-is. “Inc/Dec” allows manual adjustment using navigation buttons. “AutoInc” automatically increments the case number. “AutoInc/Pause” auto-increments but displays a confirmation prompt on the LCD before starting. These options require the Case Number in “Investigation Info” to end with a number.
• LCD Prompt Evidence: Provides five options for changing the evidence number in the “Investigation Info” section. “Disabled” leaves it as-is. “Inc/Dec” allows manual changes. “AutoInc” auto-increments. “AutoInc/Pause” auto-increments with a confirmation prompt before the action begins.

Network

The “Network” tab allows you to view and customize the settings listed below. If unsure about changes, consult your network administrator. When finished, press Commit Changes to save.

Host Name

Allows you to change the name displayed for the Ditto DX Forensic FieldStation on a network. Host names are not case-sensitive but must begin with a capital letter.

Source Network

Displays the MAC address and network mode of the source Ethernet port. Select DHCP or Static IP to set the network mode. The “Remote Accessibility” dropdown configures whether the Ditto DX responds to any network traffic over the Ethernet port.

Destination Network

Displays the MAC address and network mode of the destination Ethernet port. Select “Server,” “Client DHCP,” or “Client Static IP” to set the mode.

Server: Configures the Ditto DX Forensic FieldStation as a server. Useful when connecting an iSCSI device to the destination Ethernet port (see 11.3.2) or when connecting Ditto DX directly to your computer rather than to an office network. Do not connect a configured server to another network, as this causes network conflicts.

Client DHCP: Automatically configures the destination Ethernet port to connect to the current network.

Client Static IP: Allows manual configuration of the destination Ethernet port to connect to the current network.

Control Network

Displays the MAC address and network mode of the control Ethernet port. Select “Server,” “Client DHCP,” or “Client Static IP” to set the mode. The same Server, Client DHCP, and Client Static IP options described above apply here as well.

Wi-Fi Network

The “Wi-Fi Network” section allows configuration of a Wi-Fi adapter plugged into any USB port on the Control Interface. It also displays the port’s MAC address. Adapters with Atheros and some Realtek chipsets are supported. “Wi-Fi Mode” lets you choose between connecting to an existing Wi-Fi network and acting as a hotspot. Hotspot mode is useful when Ditto DX is within range of a wireless network but operating separately from it, or when no wired network is available.

Select “Client Mode” to connect to an existing network, or “Hot Spot Mode” to use the Ditto DX as a hotspot.

Client Mode: Check “Status: Auto Check” to automatically connect to the defined wireless network. Then select Client DHCP to automatically configure the Wi-Fi adapter, or Client Static IP for manual configuration.

Hot Spot Mode: Check “Status: Auto Check” to activate hotspot mode as soon as the Wi-Fi adapter is inserted. The default settings will work in most environments with some exceptions.

NOTE: You may need to comply with your country’s wireless radio frequency regulations. Select the 2-digit country code from the “Regulatory Domain” dropdown to restrict broadcast to the permitted frequency range. Do not connect Ditto DX to a wired network while it is operating as a hotspot, as this will cause network conflicts.

Clone

The Clone tab allows you to change the following settings for disk cloning operations, including the “Clone & Image Source Disk” operation. Press Commit Changes when finished.

Typical Settings

Source HPA/DCO: Specifies whether the cloning operation logs the presence of an HPA (Host Protected Area) or DCO (Device Configuration Overlay). Options include temporarily bypassing the HPA, showing the HPA, or showing both HPA and DCO.

Fill to End of Disk: When checked, fills the end of the disk with zeros.

Reset After Fill: Selects whether an HPA or DCO is set on the destination disk so that its capacity matches the source disk’s capacity.

Advanced Settings

Buffer Size: Adjusts the buffer size during the cloning operation. Minimum is 512 KB; default of 1 MB is sufficient for most operations.

Exit when a bad sector is encountered: Ditto DX stops the cloning operation if a bad sector is found on the source disk.

Physical Image

The Physical Image tab allows changes to physical imaging settings, including for the “Clone & Image Source Disk” operation. Press Commit Changes when finished.

E01

Click the E01 tab to view E01 image settings.

Typical Settings:

• Image File Segment Size: Specifies the segment size of the image file in bytes. Minimum is 1 MB; maximum is limited by the target file system. If left blank, the maximum size is used.
• Source HPA/DCO: Specifies whether the imaging operation logs the presence of an HPA or DCO. Options include temporarily bypassing the HPA, showing the HPA, or showing both HPA and DCO.
• Compression Type: Enables or disables free space compression.
• EWF File Format: Selects the EnCase format for E01 physical imaging. CRU recommends “encase6.”

Advanced Settings:

• Buffer Size: Adjusts the buffer size during physical imaging. Minimum is 512 KB; default of 1 MB is sufficient for most operations.
• Error Granularity: Determines how many sectors are skipped on a read error. Default equals the buffer size.
• Swap Byte Pairs of the Media Data (endian conversion): Check this box when big-endian/little-endian conversion is required. This may be necessary for drives used in legacy x86 or PowerPC-based systems. (Little-endian stores data from LSB to MSB.)
• Wipe Sectors on Read Error (mimic EnCase-like behavior): If a read error occurs during E01 physical imaging, Ditto DX fills the remainder of the sector with zeros.
• Read Error Retries: Selects how many times Ditto DX attempts to read the current sector before moving to the next.

DD

Click the DD tab to change DD image settings.

Typical Settings:

• Image File Segment Size: Specifies the segment size in bytes. Minimum is 1 MB; maximum is limited by the target file system. If left blank, maximum size is used.
• Source HPA/DCO: Specifies whether the imaging operation logs HPA/DCO presence. Same options as above.

Advanced Settings:

• Buffer Size: Minimum 512 KB; default 1 MB.
• Exit when a bad sector is encountered: Ditto DX stops the DD imaging operation if a bad sector is found.

Logical Image

The Logical Image tab allows changes to settings for the “Logical Image Source Disk” operation. Press Commit Changes when finished.

L01

Click the L01 tab to change L01 image settings.

Typical Settings:

• Image File Segment Size: Specifies the segment size in bytes. Minimum 1 MB; maximum limited by file system. Leave blank to use maximum.
• Log File Access/Modify/Change Times: Check this box to log access and modification timestamps of files and folders during the L01 imaging operation.
• Compression Type: Enables or disables free space compression.
• Per File Hash Type: Selects the default hash algorithm for specific file verification. Available formats: MD5 and SHA-1. Default is none.

Advanced Settings:

• Buffer Size: Minimum 512 KB; default 1 MB.
• Read Error Entries: Selects how many times Ditto DX attempts to read the current sector before proceeding.

ZIP and TAR Settings

Click the ZIP or TAR tab to configure settings for either logical image type.

• Log File Access/Modify/Change Times: Check this to log timestamps during the logical imaging operation.

Restore

The Restore tab allows you to view and change settings for the Restore Physical Image operation.

Typical Settings:

Fill to End of Disk: Fills the end of the disk with zeros.
Reset After Fill: Selects whether an HPA or DCO is set on the destination disk to match the source disk capacity.

Advanced Settings:
Buffer Size: Minimum 512 KB; default 1 MB.

Erase

Ditto DX allows you to view and configure settings for how disks are erased.

Erase Modes

Hash

The Hash tab allows you to view and configure settings for all hash operations.

Buffer Size: Minimum 512 KB; default 1 MB.
Exit when a bad sector is encountered: Ditto DX stops the operation if a bad sector is found on the source disk.

Naming

The Naming tab lets you configure file and folder naming settings for imaging operations.

Quick Start

The Quick Start tab allows you to change the default settings for operations displayed on the Ditto DX screen when Quick Start mode is active (enabled in the System tab). For example, you can select permitted source types and default source partitions for imaging operations.

Admin Screen

Use this screen to manage user accounts and set permissions for each user. You can add, delete, and update permissions for existing users. To add a user, press Add User, enter the username, full name, and password, select the required permissions, and click Commit Add to confirm.

Logs

The Logs screen provides information about operations performed by Ditto DX. The Action Logs section includes a timestamp, operation type, who performed the operation, and a link to detailed information. Clicking the link opens a detailed report, including disk information before and after the operation.

Utilities

The Utilities screen allows you to perform various tasks such as firmware upgrades, importing custom configuration files, remotely rebooting the Ditto DX, factory reset, and date/time updates.

Firmware Upgrade

Firmware updates are published on CRU’s website at https://wiebetech.com/software/ditto-family-firmware/downloads-for-ditto-dx/. Firmware can be upgraded in three ways:

Method 1: Paste a link

1. Ensure Ditto DX is connected to an internet-accessible network.
2. Copy the current firmware download link from the above URL.
3. In the Ditto DX browser interface, go to the Utilities screen and paste the URL into the input field.
4. Click the Firmware Upgrade button. A window will ask you to confirm the download. Click Continue.
5. Once downloaded, a confirmation window will appear. Click Continue and then OK when finished. Restart the Ditto DX.

Method 2: Download to your computer

1. Download the latest firmware file.
2. In the browser, go to the Utilities screen and click the Upload button.
3. Select the file and click the Firmware Upgrade button.
4. Once uploaded, a confirmation screen will appear. Click Continue, then OK when finished. Restart the Ditto DX.

Method 3: Load from USB drive

1. Download the latest firmware file and save it to a USB drive.
2. Insert the USB drive containing the firmware file into a USB port on the source side of Ditto DX.
3. Ditto DX will automatically scan for all firmware files on the USB drive and display them on its screen. Use the arrow buttons to select the firmware file and confirm.
4. Restart the Ditto DX when finished.

Configuration

Save Config: Click this button to save the current configuration. A screen will appear allowing you to set the configuration file name.

Load Config: After clicking Load Config, select the .xml file to import. Once confirmed, the imported settings will overwrite the current settings.

Other Settings

• Reboot: Restarts the Ditto DX.
• Date & Time: Used to set the date and time. Click the Synchronize button to sync with your browser’s settings.
• Factory Reset: Returns settings to factory defaults. The same operation can be performed using the Ditto DX front panel. See Section 9.3 for more details.
• System Verify: Checks whether the Ditto DX operating system files have been altered and adds a note to the system log. If an error is found during verification, refer to the diagnostic log for details.
• Diagnostics: Exports the diagnostic log file in HTML format. Diagnostic logs contain information such as the current configuration of the Ditto DX Forensic FieldStation, user accounts, kernel messages, logs, process information, disks, PHP errors, and system verification results.

Using the Front Panel Directly

The Ditto DX can be operated using only the front panel and directional buttons, without an external computer. Operations such as cloning, physical imaging, logical imaging, simultaneous cloning and imaging, erasing, hashing, viewing information about connected disks, and taking snapshots can all be performed from the front panel. The admin account can manage front panel access permissions from the browser interface.

You can use the directional buttons on the front panel, or alternatively connect a keyboard to the USB port on the Control Interface. Arrow keys on the keyboard perform the same functions. Press Enter to confirm the current action.