Column Content
File Status OK if there were no problems reading file data/metadata.
ERRORS if there were errors reading file data and/or
metadata.
This field is empty for directories.
Matched Rules “Y” if the file matched the acquisition's rules for inclusion.
4.6 Verifying
The standalone Verify function verifies the integrity of an existing image file by
reading back the data from the image file, calculating a hash value of that data, and
then comparing that calculated hash value with the value of the original acquisition
hash.
Note that, while the same Verify function can be used for standalone verification of
physical and logical images, the underlying mechanism is different. This is because
physical images contain whole disk acquisition hash values and logical images
contain file-based acquisition hash values. No difference will be noticed during the
verification job itself, but the source image type will make a difference in how the
results are reported. For a physical image verification job, the drive level readback
hash values will be reported in the forensic log. For a logical image verification job, a
simple pass/fail indication will be reported in the forensic log, which indicates that
all the file-based acquisition hashes matched the readback hash values. If any
individual file in a logical image file fails to verify, the entire verification job will
show as failed.
To verify an image file on a destination drive:
1. From the Home screen, tap the Verify button.
2. Enter Job notes and select a Destination drive.
4.6. Verifying
ISTX240300-UGD-EN-1
User Guide
141
To Next Page
Loading...
