Join Us!

easy aquisition sof...
 
Notifications
Clear all

easy aquisition software  

  RSS
zemaria523
(@zemaria523)
New Member

Hi, I need a portable software that I could drag and drop files into it and generate an E01, DD, L01 or anything like that and get its SHA-1 hash. Something like FTK Imager, but that I could drag and drop files directly from an Windows Explorer window to the "custom content sources". Is there someone that do it?

thanks.

Quote
Posted : 22/05/2020 12:14 am
Topic Tags
jaclaz
(@jaclaz)
Community Legend
Posted by: @zemaria523

Hi, I need a portable software that I could drag and drop files into it and generate an E01, DD, L01 or anything like that and get its SHA-1 hash. Something like FTK Imager, but that I could drag and drop files directly from an Windows Explorer window to the "custom content sources". Is there someone that do it?

thanks.

Why not the FTK imager command line version and a batch?

http://aaforensics.blogspot.com/2017/09/command-line-ftk-imager.html

If you don't *need* E01, but you want a DD and a MD5 (not SHA-1) hash you can use the smaller/simpler DSFO (part of the DSFOK toolkit, but you are talking of files, so it makes little sense to talk of E01, and making a dd image of a file plainly means "make a copy of it", so maybe ultimately you want something capable of calculating the SHA-1 hash of a file? 

jaclaz

ReplyQuote
Posted : 22/05/2020 12:18 pm
zemaria523
(@zemaria523)
New Member

Becouse the people that would use it have not experience with those softwares, I Just want, as encase and ftk do, logical files, as AD and L01, encapsulate in a file, but a manager should accept drag and stop files/folders and generate a sha-2 hash of this logical filé created.

Basically a ftk imager with drag and drop. If I say "you have to add the logical partition, navegate from the tree, add the file to custom content...", It wont be done.

ReplyQuote
Posted : 22/05/2020 1:50 pm
jaclaz
(@jaclaz)
Community Legend

Well, last time I used one of them, batch files did support drag 'n drop just fine.

Still it is not clear what the "source" is.

If it is a disk or a volume, you need something capable of imaging a disk or a volume, if it is "files" then you do not need *any* container like AD or L01, a common archive format will do nicely.

As an example only, Peazip can calcualte (and store) the SHA-1 (or other hash) to files in an archive.

https://www.peazip.org/verify-checksum-hash.html
https://www.peazip.org/pea-archiving-utility.html
https://www.peazip.org/pea-file-format.html

jaclaz

ReplyQuote
Posted : 22/05/2020 3:27 pm
zemaria523
(@zemaria523)
New Member

The source would be a disk or a mapped drive.

Its something like Peazip I was looking for, the only thing is that it doesnt do the file hash at the same time it is compressing, as FTK does. So I would have to run it two times, one to make the .7z and other to calculate its hash.

 

Thank you for your help.

ReplyQuote
Posted : 23/05/2020 1:01 am
jaclaz
(@jaclaz)
Community Legend
Posted by: @zemaria523

Its something like Peazip I was looking for ...

Good, have a look at this (backup/copy+hashing):

https://www.2brightsparks.com/resources/articles/introduction-to-hashing-and-its-uses.html

might be what you need.

jaclaz

ReplyQuote
Posted : 23/05/2020 2:21 pm
jaclaz
(@jaclaz)
Community Legend
Share: