CRU Ditto Foensic FieldStation User manual

PMS711 2cyan
85magenta
76yellow
10.25.12
CRU Mark
Page 2
1.2 Identing Parts
Take a moment to familiarize yourself with the parts of the
Ditto. This will help you to better understand the following
instructions.
1. Pre-Installation Steps 2
1.1 Box Contents 2
1.2 Identifying Parts 2
2. Setup 3
3. Web Browser Interface 3
3.1 Accessing the Web Browser Interface 3
4 Home Screen 4
4.1 Action 4
4.2 Investigation Info Panel 5
4.3 Settings 5
4.4 Current Status 5
4.5 Disks 5
4.6 System Log 5
4.7 Advanced Features/functions 5
4.7.1 Usage of NetView Scan 5
4.7.2 Target Mode 8
4.7.3 Using Network Source and Destination 9
5. Congure Screen 11
6. Admin 13
7. Logs 13
8. Utilities 14
9. Usage of Ditto Through the LCD 14
9.1 Status Screen 14
9.2 Settings 15
9.3 Disk Info 15
9.4 Perform Action 15
9.6 Factory Reset 16
10. Technical Specications 17
Top of Unit
Power Available LEDs
LCD Menu
Destination LEDs
Navigation buttons for LCD Menu
Source LEDs
Source Inputs
(all inputs are write-blocked)
RJ45 Gigabit Ethernet connection 4-pin Molex (DC Power Output)
PATA connection
Expansion Module connection
USB2 type A connection eSATA connection
Destination Outputs
RJ45 Gigabit Ethernet connectioneSATA connections
Stealth Mode Switch 4-pin Molex (DC Power Output)
Table of Contents
1. Pre-Installation Steps
1.1 Box Contents
The following list contains the items that are included in
the complete conguration for this device. Depending on
which conguration and accessories you purchased, the
package may include fewer items than what are listed here.
Please contact CRU if any items are missing or damaged:
Ditto Unit 1
Unitized SAS to eSATA + mini-t power cable 3
IDE cable 1
12V Power Supply 1
Power cord 1
Legacy Power to mini-t cable 1
Ethernet cable (RJ45) 1
2.5 IDE to 3.5 IDE and mini-t cable 1
Power adapter, legacy to SATA 1
Velcro cable wrap 6
eSATA cable 2
SD card (pre-installed) 1
Quick Start Guide and Warranty Info 1

PMS711 2cyan
85magenta
76yellow
10.25.12
CRU Mark
Page 3
e. Type your source IP address into your web browser.
If you know the address, skip to step “i.” If you do
not know the address, continue with step “f.”
f. Press the DOWN navigation button on Ditto until
you reach the “Settings” menu. Then Press ENTER.
g. Press the UP or DOWN navigation buttons until you
reach the “Source IP Address” screen.
h. Type the IP address shown into your web browser.
• Note that Ditto is congured to use DHCP for IP
assignment. If you need to change to a Static IP, check
with the network administrator and see section 3.3.2 of
this manual.
i. Log into the web browser interface. (the default
username and password are both “admin”)
• CRU recommends changing the admin password and
setting the users accounts for best data management.
Alternatively, the web browser interface can be
accessed via a computer. Connect an Ethernet cable
from the “Destination Outputs” Ethernet port to your
laptop. Your Ditto is pre-programmed with a static
IP address of 10.10.10.1 on the destination side. (The
Destination IP Address can also be seen in the LCD’s
Settings menu). Type this IP address into your web
browser to access the Ditto’s web browser interface.
WARNING: The destination Ethernet port may also
be congured as a DHCP server. Attaching the Ditto
to a network with an existing DHCP server will cause
network issues.
You are now ready to use Ditto’s web interface to
congure settings, preview the attached drives, run an
image or clone.
2. Setup
Plug the “suspect” drives or devices into the “Source Inputs”
side of Ditto. All source inputs are write-blocked to prevent
alteration. The source inputs include a USB 2 connection for
USB devices, an RJ45 Gigabit Ethernet connection, a PATA
drive connection, and an eSATA connection for SATA drives
or an eSATA device. The expansion module connection is
used with Ditto expansion modules (available soon).
Use the “Destination Outputs” side of Ditto to store acquired
data. The destination output connections are two eSATA
connections for SATA drives or eSATA devices and an RJ45
Gigabit Ethernet connection.
When you add or remove a drive or enclosure from Ditto, CRU
recommends that you switch the power off to Ditto to avoid
drive damage or data corruption.
The rear of Ditto has an SD card slot and two powering
options: a 12V input for the power supply, and a SATA power
connection. The rear of Ditto also has a hanging hook for
hanging the unit inside the computer case or workstation.
3. Web Browser Interface
Ditto can be congured and operated either from the LCD
interface (see section 9) or through a web browser interface.
3.1 Accessing the Web Browser Interface
a. Plug an Ethernet cable into the Ethernet port on the
“Source Inputs” side of Ditto.
b. Connect the other end of the Ethernet cable to
your network. This usually means plugging it into a
router or hub. In an ofce environment, you may have
a network jack built into your ofce wall.
c. Connect the power cable to the rear of Ditto and to
the provided AC adapter or to SATA power.
d. Turn on Ditto’s power using the switch on the rear
panel. (0 = off, 1 = on)
Hanging hook
Power Input for AC supply
SATA power connection
SD card slot
Power switch
Rear of Unit
Settings
View/Edit >
Source IP Address
10.xxx.xx.xx

PMS711 2cyan
85magenta
76yellow
10.25.12
CRU Mark
Page 4
4. Home Screen
4.1 Action – The Main screen lets you start, abort, and
make notes about the following actions:
4.1.1 Clone Source Disk: Ditto makes an exact
duplicate of the source disk. While cloning the source
disk, the Ditto is also able to hash the source drive using
MD5, SHA-1, or MD5 + SHA-1 and save the hash value.
Ditto can clone to one destination drive or two destination
drives (Mirror feature).
4.1.2 Image Source Disk: Ditto makes a copy of the
source drive into les on to one destination drive or two
destination drives (Mirror feature). E01 and DD are the
two imaging types. While imaging the source disk, the
Ditto also can hash the source disk using MD5, SHA-
1, or MD5 + SHA-1. TIP: For fastest performance we
recommend utilizing EXT4 le system for Windows,
HFS+ for Mac, and XFS for Linux machines.
Note: For the Mirror feature to be shown, both destination
drives must be empty. Tip: A quick way to accomplish
this is to use Ditto to erase each drive using the setting
“Clear Partition Table”.’
4.1.3 Clone and Image Source Disk: This action
simultaneously performs a clone to one destination disk
and perform an image to the second destination disk.
Two destination disks are required for this action.
Note: While running a clone and image, the hash
algorithm saved under clone setting will be used.
4.1.4 Erase Destination Disk: Ditto erases the
destination drive using the pre-congured erasure
method.
4.1.5 Hash Disk: Ditto hashes either the source or the
destination disk (user select) with the hash algorithm
pre-congured. Hash values are saved in the log.
4.1.6 Snapshot Disk: Ditto provides SMART and
HDParm information whenever needed. No clone or
image request needs to be done.
4.1.7 NetView Scan: NetView is a network probing
tool which can be used to discover machines on a
network and even probe them for specic services
which they may be running. This capability may help
an Investigator locate physically hidden computer and
quickly determine whether or not a machine is acting
as a data storage device which may be imaged by Ditto.
See section 4.7.1 for more information about the
NetView Scan feature.

PMS711 2cyan
85magenta
76yellow
10.25.12
CRU Mark

PMS711 2cyan
85magenta
76yellow
10.25.12
CRU Mark
Page 6
4.7.1.1 Info Feature: At any time you may click on the
information icons for a brief description of each individual
setting.
4.7.1.2 Reset Feature: At any time you may click on one
of the Reset icons to load the defaults for that particular
setting.
4.7.1.3 Interface Selection: Select either Source or
Destination from the “Interface” drop-down.
WARNING: When the scan is started the selected
interface will used. This will cause heavy network trafc
load and almost certainly alert your IT department that
the network is under some sort of threat. Ensure that the
selected interface is attached to a controlled and isolated
network.
4.7.1.4 IP Scan Range: By default the last octet of the
IP address of the selected interface will be scanned. You
may change this value and enter a list of IP address, a
range of IP addresses, or a combination of both.
Examples:
1. Range: 10.10.10.0-255
• This will scan the addresses 10.10.10.0 through
10.10.10.255.
2. Range 2: 10.10.10-12.0-255
• This range will scan addresses 10.10.10.0-255,
10.10.11.0-255, and 10.10.12.0-255.
3. List: 10.10.10.1
• This will only scan IP address 10.10.10.1
4. List 2: 10.10.10.2,10.10.10.3
• This will scan only hosts 10.10.10.2 and 10.10.10.3
5. Combo: 10.10.10.1,10.10.10.2,10.10.10.50-100
• This will scan hosts 10.10.10.1, 10.10.10.2 and
hosts 10.10.10.50 through 10.10.10.100.
Remember that the “Reset” button may be used to reset
the IP Scan Range back to its default values.

PMS711 2cyan
85magenta
76yellow
10.25.12
CRU Mark
Page 7
4.7.1.5 Discovery Options: There are 3 optional host
(machine) discovery options available. By default, the
“Ping Echo” should be enough in most cases. Some
machines may be congured to ignore pings and not
respond, so there are 2 other specialized Ping options
which may be useful.
Zero or more of these discovery options may be selected,
and the “Reset” button may be used to reload the defaults.
4.7.1.6 TCP Options: NetView can optionally scan the
specied hosts for open TCP ports. By default Ditto scans
for commonly used services as well as services to which
Ditto may be able to connect, such as NFS, iSCSI, and
Samba.
Checking the box next to “TCP Options” enables this
features and expands more options. Again, the “Reset”
button may be pressed to reset all TCP Options back to
their default values.
Once the TCP Options are expanded we then have more
options.
4.7.1.7 TCP Ports: Similar to the IP Scan Range text box,
the Ports text box can be used to specify lists or ranges
of TCP ports which you would like Ditto to scan. Only the
specied ports will be scanned. Examples:
1. Range: 1-1000
• This will scan TCP ports 1 through 1000
2. List: 22,80
• This will only scan TCP ports 22 (SSH) and 80
(HTTP)
3. Combo: 1-25,80
• This will scan TCP ports 1 through 25 and TCP
port 80.
4.7.1.8 TCP Scan Types: There are two TCP scanning
options. Only one may be selected at a time and a selection
is mandatory. By default the “Syn Scan” is selected,
which is appropriate for most cases. The “Connect Scan”
option may be used if you want Ditto to attempt to create
a system level connection to the specied services. The
“Connect Scan” should only be used by advanced users.
4.7.1.9 UDP Options: NetView can optionally scan
the specied hosts for open UDP ports. By default Ditto
scans for commonly used services as well as services to
which Ditto may be able to connect, such as NFS, iSCSI,
and Samba. UDP port scanning takes much longer than
TCP port scanning due to the connectionless nature of
the UDP protocol, which makes it difcult to determine
whether the packet sent to the port has been lost or the
port is simply not open.
Checking the box next to “UDP Options” enables this
features and expands more options. Again, the “Reset”
button may be pressed to reset all UDP Options back to
their default values.

PMS711 2cyan
85magenta
76yellow
10.25.12
CRU Mark
Page 8
Similar to the IP Scan Range text box, the Ports text box
can be used to specify lists or ranges of UDP ports which
you would like Ditto to scan. Only the specied ports will
be scanned.
Examples:
1. Range: 1-1000
• This will scan UDP ports 1 through 1000
2. List: 69,137
• This will only scan UDP ports 69 (tftp) and
137 (netbios)
3. Combo: 1-25,137
• This will scan UDP ports 1 through 25 and UDP
port 137.
4.7.1.10 Starting the Scan: To start the NetView
scan using the present conguration click on the “Start”
button.
Similar to when other actions run, you should see status
information about the scan. Note that the progress
estimates are VERY crude and still being developed. The
user should see updates every few seconds describing
the current scan being executed, the number of host
discovered, and the progress of the current scan.
4.7.1.11 NetView System Log Results: The system
log will display a summary of the NetView action as it
runs. Once complete you should see the complete scan
system log summary. Displayed will be a link to the
Session (Action) log, arguments used during the scan,
and a “Finished” entry.
4.7.1.12 NetView Session (Action) Log: When you
click on the Session log link in the System Log, then
you will be presented with a NetView session log.
The NetView session log will contain a section which
summaries the discovered hosts. The IP Address, MAC
address, Service, Port #, Protocol and State elds should
all contain information.
The MAC Manufacturer eld may contain the name of
the manufacture associated with the MAC address if
this information can be determined.
The Hostname will be blank if a DNS lookup could not
associate the hosts IP address to a name.
4.7.2 Target Mode: It is possible to mount drives
connected to Ditto on your computers via iSCSI. This can
be very useful if you wish to scan, image, or otherwise
use the disk with 3rd party software.
Using either the source or destination network port works
equally well.

PMS711 2cyan
85magenta
76yellow
10.25.12
CRU Mark

PMS711 2cyan
85magenta
76yellow
10.25.12
CRU Mark
Page 10
After these settings are congured on Ditto and the
iSCSI device, simply ensure that the iSCSI device is
connected to the Source Ethernet port.
On the home screen select “iSCSI Sources” or “iSCSI
Destinations” as appropriate. Input the IP of the iSCSI
device into the Target Host eld. Press “Discover.” Ditto
will detect any IQNs attached to the IP address. Select
the IQN you wish to attach to and press “Add.” Close the
iSCSI pop-up. The iSCSI device has now been added to
the list of disks.
If an iSCSI volume needs to be removed, be sure to select
it from the iSCSI Sources or Destinations window and
press “Remove” before physically removing it from the
network. This will prevent timeout issues where Ditto
attempts to connect to an iSCSI volume that does not
exist.
4.7.3.2 Using NFS/Samba Sources and
Destinations: Ditto can interact with drives or folders
over the network.It can be used to image from the
attached source drives to network destinations via NFS
and Samba Shares.
Ditto comes pre-congured to attach to NFS and Samba
Shares. To connect your Ditto to an NFS or Samba
Share, ensure that the directory is available. For details
on creating an NFS or Samaba Share, contact your IT
Department.
Select either “Source Network” or “Destination Network”
from the Home screen in the web browser interface.
A Network pop-up will open.
Enter the Server name or the path to the NFS or Samba
Share and select “Show Shares.” This will bring up the
available Shares.
Select the appropriate Shares then select “Add.”
The shared drive will now be listed in the Network Paths
window on the Network pop-up.
If Authentication is require for a Samba Share select
Advanced and enter the User Name and Password
Once you verify that that the shared drive is listed,
select “close.”
The Shares will now be available and added to the list
of disks.
To remove the shares, click on “Source Network” or
“Destination Network” as appropriate. Select the iSCSI
or NFS or Samba tab and check the box next to the
share(s) you wish to remove. Click the “Remove” button
to remove that share.