Acquiring Digital Data - Choosing

Acquiring Digital Data - Choosing the Right Methods/u06d1 Creating a Hash

Choosing acquisition methods for a hard drive consider thought and research; in actually once you have purchased a hard drive it is probably shortly going to be out of date with something new, better, and faster with more or updated options. According to Directron.org (2010), the best choice for choosing a hard drive, RAID, etc. is to have an understanding of the hard drive, how it operates, and what it does. Normal hard drives like the ones everyone uses are Parallel ATA (PATA). The newer version is a Serial ATA (which boosts transfer speeds up to 150 MBs [and up to 300MB/s bursts with SATA2 technology) as opposed to a max of 133 MBs with parallel interface. The SATA standard also improves airflow in the case because wide ribbons are no longer needed and a somewhat thin compact cable is used instead. Additionally, SATA2 offers a few features like Native Command Queuing, eSATA and other.

However - using SATA means you will need a SATA controller, a SATA drive, and a SATA power cable. The actual speed improvement of SATA vs. PATA is not much noticeable with current drives unless you are talking about the high end SATA drives using RPMs higher than 7200 which can burst through a wider channel than PATA. If you are building an average/upper end system there is currently no pressing reason to go SATA unless you are building for the future. PATA standard is slowly dying out and high-end motherboards stop even including PATA support for hard drives, they still include one. (Michael & Penrod, n.d., para. 5)

So to answer the question clearly, when searching for a hard drive RAID, etc. consider what you are going to be doing, and what you need the drive to hold, how will the speed effect what you are doing etc. Once that it clear then all that is needed is to make the best pick for your current a future needs. And the most important is that by using a swappable device like SATA makes it easier to acquire evidence from a suspect drive. There are and will always be drawbacks i.e. contamination or corruption of info, so that too should be considered. PATA's and SATA's allow connection without the use of an addition USB port which is important when dealing with registry modification. A combination of Ethernet and USB data acquisition products would be useful.

A hash is a one way operation that is performed on a block of data to create a unique hash value that represents the contents of the data. No matter when the hash is performed, the same hashing algorithm performed on the same data will always produce the same hash value. If any of the data changes, the hash value will change appropriately. Hashes are not useful for encrypting data because they are not intended to be used to reproduce the original data from the hash value. Hashes are most useful to verify the integrity of the data when used with an asymmetric signing algorithm. ("Creating a Hash with CNG," 2010, para. 1)

In choosing a hash the one chosen for this essay is the HashTab Shell Extension to Windows, HashTab provides OS extensions to calculate file hashes. HashTab supports many hash algorithms such as MD5, SHA1, SHA2, RipeMD, HAVAL and Whirlpool. Hashtab is supported as a Windows shell extension and a Mac Finder plug-in. HashTab provides an easy way to verify file integrity and authenticity. The main reason for choosing HashTab is its ability to work with Windows XP and it is one of the easier hash programs to manipulate and navigate through.