CRU WiebeTech Ditto Shark User manual

Wiebetech Branding
2c85m76y
PMS 711C
66c7m7y
PMS 299C
Product Name:
Univers 73 Black Extended
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
CRU®WiebeTech®Ditto®Shark
User Manual
Features
• Standalone product—operates without a PC or a Ditto Forensic FieldStation
• Captures Internet and VOIP traffic with virtually no packet loss*
• Captures sustained 10/100 Mbps network traffic and short burst gigabit network traffic*
• Filter and capture network traffic to a tcpdump/Wireshark-compatible PCAP file
• Optional live capture stream (rpcap) interface for Wireshark
• Removable drive carrier for data storage
• Fail-safe design continues passing through network traffic if power is lost
• Free firmware updates for registered users
*Packet loss is a function of the type and saturation level of traffic on the tapped network

2
Protecting Your Digital AssetsTM
CRU Ditto Shark User Manual
6 Admin Screen 20
6.1 User Accounts 20
6.2 Permissions 20
6.3 Adding a New User 21
6.4 Editing an Existing User 21
6.5 Deleting a User 21
7 Logs Screen 21
8 Utilities Screen 22
8.1 System Maintenance 22
8.1.1 Firmware Upgrade 22
8.1.2 Configuration 22
8.1.3 Other Buttons 22
8.2 Upgrade Log Messages 23
8.3 Import Log Messages 23
9 Using the Front Panel Interface in Standalone Mode 23
9.1 How to Navigate 23
9.2 Menu Screens 23
9.2.1 Status 23
9.2.2 Perform Action 24
9.2.3 Investigation Info 24
9.2.4 Settings 25
9.2.5 Disk Info 28
9.3 Factory Reset 28
10 Stealth Mode 28
11 Advanced Features and Functions 28
11.1 Using iSCSI Devices 28
11.2 Using NFS and SMB (Samba) Shares 30
11.3 Using and Configuring Network Capture Filters 31
12 Upgrading Firmware 32
13 Technical Specifications 34
TABLE OF CONTENTS
1 General Information 3
1.1 Package Contents 3
1.2 Identifying Parts 3
1.3 LED Behavior 3
1.4 Thermal Cooling 3
1.5 How to Use the Ditto Shark 4
2 Setup 4
3 Browser Interface 6
3.1 Accessing the Browser Interface 6
3.2 Icons Used in the Browser Interface 6
3.3 User Accounts 6
4 Home Screen 7
4.1 Action 7
4.1.1 Network Capture 7
PCAP Network Capture 7
Live Network Capture 8
Simultaneous PCAP and Live Network
Capture 9
4.1.2 Erase Destination Disk 9
4.2 Investigation Info 10
4.3 System Settings 11
4.4 Current Status 11
4.5 Disks 11
4.5.1 View Hexidecimal Data 11
4.5.2 View Snapshot Data 11
4.6 System Log 12
5 Configure Screen 12
5.1 System 12
5.2 Network 14
5.3 Erase 17
5.4 Network Capture 17
5.5 Naming 19
5.6 Quick Start 19

3
Protecting Your Digital AssetsTM
CRU Ditto Shark User Manual
1 GENERAL INFORMATION
1.1 PACKAGE CONTENTS
The following list contains the items that are included in the
complete configuration for this device. Please contact CRU if
any items are missing or damaged:
Item Quantity
Ditto Shark 1
40W 12V AC adapter 1
Power cord 1
Unitized SATA-to-eSATA + Mini-Fit power cable 2
Ethernet cable (RJ45) 2
4GB SD card (pre-installed) 1
User Manual 1
1.2 IDENTIFYING PARTS
Take a moment to familiarize yourself with the parts of the
product. This will help you to better understand the following
instructions.
LCD Display
FRONT PANEL
Hanging Hook
Navigation
Buttons
REAR OF THE UNIT
Power Switch
SD Card Slot Power Input for
AC Adapter
RJ45 Gigabit
Ethernet Connection
NETTAP INTERFACE
RJ45 Gigabit
Ethernet Connection
USB 2.0 Port
DP20 Keylock/
Eject Button
DESTINATION INTERFACE
Stealth Mode
Switch
DP20 Status
Lights
DP20
Carrier
eSATA Ports &
Power Connectors
RJ45 Ethernet
Connection
1.3 LED BEHAVIOR
LED COLOR STATE DESCRIPTION
DP20 Power Green Solid The DP20 is powered
on.
DP20 Drive
Activity Amber Solid or Blinking
The drive inside the
DP20 is being ac-
cessed.
1.4 THERMAL COOLING
The Ditto Shark is a passively cooled system that pulls heat
out of the processor and other electronics into the all-metal
housing where it dissipates. The heat generated by the Ditto
Shark is an intended design feature that eliminates the need
of a noisy internal cooling fan and drastically reduces the
amount of particulates that are pulled through the system.

4
Protecting Your Digital AssetsTM
CRU Ditto Shark User Manual
1.5 HOW TO USE THE DITTO SHARK
The Rear Interface side of the Ditto Shark has a power switch, a 12V input for the included power supply
and an SD card slot from which to store configuration data.
Use the NetTap Interface side of the Ditto Shark to insert the Ditto Shark in between the target computer
and the network it is connected to. The available connections include two RJ45 gigabit Ethernet ports and a
USB 2.0 port for use with USB storage devices, a keyboard, or a wifi adapter. Both RJ45 ports are direction
agnostic, so it doesn’t matter which port is used to connect to the network and which is used to connect to
the target computer.
Use the Destination Interface side of the Ditto Shark to store acquired data. The destination output con-
nections include a CRU DataPort DP20 and two eSATA ports for SATA disks or eSATA devices. It also
includes an RJ45 gigabit Ethernet port to allow network access to the Ditto Shark’s Browser Interface (see
Section 3) and a stealth switch that will turn off all external lights and enable nightvision display via Stealth
Mode (see Section 10).
CRU recommends that you switch the power off to the Ditto Shark when you add or remove a device
from it in order to avoid disk damage and data corruption.
2 SETUP
a. Leave the Ditto Shark disconnected from the network until you have configured it
properly using the steps below.
b. Connect the power cable to the rear of the Ditto Shark and turn the Ditto Shark on with
the power switch located on the rear of the unit.
c. Press the Down navigation button on the Ditto Shark until you reach the “Settings”
menu (see Figure 1) on the Front Panel. Then press Enter to view the Settings.
d. Press Up or Down until you reach the “Dst Network Settings” screen shown in Figure
2 and press Enter.
e. Press Up or Down until you reach the “Dst Network” screen shown in Figure 3.
f. If the text on the second line says “Disabled”, press the Enter button to edit the set-
ting. Press Up once and then Enter to commit the change. If the text says “Enabled”,
continue to the next step.
g. Press Up or Down until you reach the “Dst Network Mode” screen shown in Figure 4
and then press Enter to edit the setting.
h. The Ditto Shark has three connection modes. Press Up or Down to choose which way
you would like to use the Ditto Shark and press Enter to select it.
• Client (DHCP): The Ditto Shark acts as a client on the network and automatically
detects network parameters (e.g. IP address, gateway, etc.) from a DHCP server
on the network. DHCP is the protocol used by most network environments today.
Unless your network administrator directs otherwise, you should probably use this
mode.
NOTE
Dst Network Settings
View/Edit >
Figure 2. A depiction of the “Dst Network Settings”
screen on the Ditto Shark.
Settings
View/Edit >
Figure 1. A depiction of the “Settings” menu on the
Ditto Shark.
Dst Network:
Disabled
Edit >
Figure 3. A depiction of the “Dst Network” screen on
the Ditto Shark.

5
Protecting Your Digital AssetsTM
CRU Ditto Shark User Manual
• Client (Static IP): The Ditto Shark acts as a client on the network and you manu-
ally input all network parameters (e.g. IP address gateway, etc.).
• Server: The Ditto Shark acts as the master DHCP server on the network and you
manually input all network parameters. The server mode is also used to directly
connect Ditto Shark to a computer.
After your first-time setup, always ensure that the Ditto Shark is properly config-
ured to use the proper connection mode before you connect your Ditto Shark to
a different computer or network. An improperly configured Ditto Shark can cause
networking conflicts on the host network.
The Ditto Shark is configured by default to use “Network Client (DHCP)” mode
so that it will not conflict with the most common types of networks.
i. If you selected Client (Static IP) or Server, then follow additional steps in Section 2.1
below.
If you selected Client (DHCP), you are ready to start using the Ditto Shark. You may
access its settings via the Browser Interface (see Sections 3-8) or via the Front Panel
(see Section 9).
2.1 ADDITIONAL STEPS FOR “CLIENT (STATIC IP)” AND “SERVER”
a. Press Up or Down until you reach the “Dst IP Address” screen shown in Figure 5.
b. Press Enter to edit the IP address. You can use a keyboard that you’ve attached
to the USB 2.0 port on the “NetTap Interface” side of the Ditto Shark to enter the
static IP address your network administrator gave you.
If you do not have a keyboard, press Back and Enter to scroll the cursor right and
left, and press Up or Down to increase or decrease the number highlighted by the
cursor.
c. When you have finished, press Enter until the cursor has moved all the way to the right, and then press
Enter once more to commit the changes.
d. Press Up or Down until you reach the “Dst Subnet Mask” screen shown in Figure 6 and press Enter to
edit the subnet mask.
e. Use the keys on the Front Panel or your USB keyboard to enter the subnet mask your network admin-
istrator gave you. If your administrator did not give you a subnet mask, the default setting will usually
suffice.
f. When you have finished, press Enter until the cursor has moved all the way to the right, and then press
Enter once more to commit the changes.
Additional network parameters can be input using the Browser Interface’s Configure screen (see Sec-
tion 5.2)
You are ready to start using the Ditto Shark. You may access its settings via the Browser Interface (see Sec-
tion 3) or via the Front Panel (see Section 9).
Dst Network Mode:
Client (Static IP)
Edit >
Figure 4. A depiction of the “Dst Network Mode”
screen on the Ditto Shark.
Dst IP Address:
10.10.0.1
Edit >
Figure 5. A depiction of the “Dst IP Address” screen
on the Ditto Shark.
Dst Subnet Mask:
255.0.0.0
Edit >
Figure 6. A depiction of the “Dst IP Address” screen
on the Ditto Shark.
NOTE
STOP!
NOTE

6
Protecting Your Digital AssetsTM
CRU Ditto Shark User Manual
3 BROWSER INTERFACE
The Ditto Shark can be configured and operated either from the Front Panel (see Section 9) or through a web
browser.
3.1 ACCESSING THE BROWSER INTERFACE
a. Using the Front Panel, navigate to “Dst Network Settings” →“Dst IP Address”.
b. Type the IP address shown into your web browser.
c. Log into the Browser Interface (the default user name and password for the administrator account are
both “admin”).
CRU recommends that you change the admin account password and create user accounts for indi-
vidual users as best data management practices.
You are now ready to use the Browser Interface to configure settings and preview, image, or clone attached
disks.
3.2 ICONS USED IN THE BROWSER INTERFACE
The Browser Interface uses several icons that may be clicked on to perform certain actions.
ICON ACTION
Information Opens a window with a brief description of the setting that the information icon appears
next to.
Refresh Refreshes the field that the icon appears next to in order to give updated information.
Reset Loads the defaults for the setting that the Refresh icon appears next to.
Add Adds a user defined field to a list of items.
Remove Removes a user defined field from a list of items.
3.3 USER ACCOUNTS
The Ditto Shark employs a user account system to control access to its features. The “Login” screen
presents you with the ability to log in through http, or you can click the Secure Login (HTTPS) link to log
in securely. Accept the certificate and/or continue to the website, even if your browser tells you it does not
recognize it.
The default user name and password for the Administrator account are both “admin”. CRU recommends
that you change the admin account password and create user accounts for individual users as best data
management practices.
Click on the Log Out button at the top right of the Browser Interface to log out.
NOTE

7
Protecting Your Digital AssetsTM
CRU Ditto Shark User Manual
4 HOME SCREEN
The “Home” screen is where you will perform most of your operations with the Ditto Shark, and is the default
screen to load upon logging into the Browser Interface. Click on the Home tab to access the “Home” screen
from any other area of the Browser Interface.
4.1 ACTION
The “Action” panel lets you start, abort, and document the following actions. The “Start” button begins the
action. The “Abort” button stops the action in progress. Click the Comment button to write a note that will
be appended to the log. Click the Configure button to modify the default settings for each action, which
can also be modified on the “Configure” screen (See Section 5).
4.1.1 Network Capture
The Ditto Shark provides two methods of capturing network traffic that can be combined and used
simultaneously if you wish. The first method captures network traffic and stores it in a series of incre-
mented PCAP files on the local target destination. The second method captures network traffic in
real-time and outputs it to a remote monitor that uses a third-party Wireshark network protocol analyzer.
Instructions for both methods as well as instructions for using them simultaneously can be found below.
PCAP Network Capture
a. Using the Browser Interface, select Network Capture from the “Action to Perform” drop-down
box.
b. Select the network capture filter from the “Network Capture Filter” drop-down box or type in
the ports you wish to capture in the text box directly below that using the syntax “port ## or ##”
without quotes (e.g. port 80 or 81 or 443).
Figure 7. The “Home” screen.

8
Protecting Your Digital AssetsTM
CRU Ditto Shark User Manual
c. Select “NetTap” from the “Interface” drop-down box.
d. Select the media from the “Destination” drop-down box that you want Ditto Shark to save your
captured data.
e. Select the partition on the destination media you want to capture to from the “Partition” drop-
down box.
f. Bypass “Live Network Capture” and leave it disabled.
g. Click the Start button to begin capturing network data. When you are finished, click the Stop
button.
You can view the log of the network capture action by scrolling down to the “System Log” panel
on the “Home” screen. Find and click on the latest link, which will be denoted by a filename with a
date/timestamp format: “S_yyyymmddhhmmss”. Alternatively, you can click on the Logs button
from the top menu bar.
You can view the data retrieved from the network capture action by examining the destination
media, which will contain a folder named with the same data/timestamp format: “S_yyyymmd-
dhhmmss”, which includes the PCAP files containing the captured data, an XML file containing the
log information of the network capture, and—if hashing is enabled—a TXT file that contains each of
the generated PCAP files’ MD5 or SHA-1 hash value (see Section 5.1.2 to enable hashing).
Live Network Capture
a. Using the Browser Interface, select Network Capture from the “Action to Perform” drop-down
box.
b. Select the network capture filter from the “Network Capture Filter” drop-down box or type in
the ports you wish to capture in the text box directly below that using the syntax “port ## or ##”
without quotes (e.g. port 80 or 81 or 443)
c. Disregard the “Interface” and “Destination” drop-down boxes.
d. Ensure your third party Wireshark network protocol analyzer is standing by to receive data. If you
need help in configuring Wireshark itself, click the Information icon next to “Live Network
Capture” for a link to Wireshark’s remote capture documentation.
e. Click the Enable button next to “Live Network Capture” to turn live network capture on. When
you are finished capturing network traffic, click the Disable button.
Do NOT click the Start button! This button actually enables the PCAP network capture function that
captures network traffic to your local destination media. It does NOT enable live network capture.
Figure 8. The “Action” section on the “Home” screen, showing
the options available for the “Network Capture” action.
STOP!

9
Protecting Your Digital AssetsTM
CRU Ditto Shark User Manual
Simultaneous PCAP and Live Network Capture
a. Using the Browser Interface, select Network Capture from the “Action to Perform” drop-down
box.
b. Select the network capture filter from the “Network Capture Filter” drop-down box or type in
the ports you wish to capture in the text box directly below that using the syntax “port ## or ##”
without quotes (e.g. port 80 or 81 or 443).
c. Select “NetTap” from the “Interface” drop-down box.
d. Select the local media from the “Destination” drop-down box that you want Ditto Shark to save
your captured data to as a series of incremented PCAP files
e. Select the partition on the local destination media you want to capture to from the “Partition”
drop-down box.
f. Ensure your third party Wireshark network protocol analyzer is standing by to receive data. If you
need help in configuring Wireshark itself, click the Information icon next to “Live Network
Capture” for a link to Wireshark’s remote capture documentation.
g. Click the Enable button next to “Live Network Capture” to turn live network capture on. When
you are finished capturing network traffic, click the Disable button.
h. Click the Start button to begin capturing network data to your local destination media. When
you are finished, click the Stop button.
You can view the log of the PCAP network capture action by scrolling down to the “System Log”
panel on the “Home” screen. Find and click on the latest link, which will be denoted by a filename
with a date/timestamp format: “S_yyyymmddhhmmss”. Alternatively, you can click on the Logs
button from the top menu bar.
You can view the data retrieved from the PCAP network capture action by examining the destina-
tion media, which will contain a folder named with the same data/timestamp format: “S_yyyymmd-
dhhmmss”, which includes the PCAP files containing the captured data, an XML file containing the
log information of the network capture, and—if hashing is enabled—a TXT file that contains each of
the generated PCAP files’ MD5 or SHA-1 hash value (see Section 5.1.2 to enable hashing).
4.1.2 Erase Destination Disk
The Ditto Shark erases your preferred destination media. The available Erase Modes are Clear Partition
Table and Quick Erase.
To erase a disk, follow these steps:
a. Select Erase Destination Disk from the “Action to Perform” drop-down box.
Figure 10. The “Action” section on the “Home” screen, showing
the options available for the “Erase Destination Disk” action.

10
Protecting Your Digital AssetsTM
CRU Ditto Shark User Manual
b. Select the Erase Mode to use from the “Erase Mode” drop-down box. (You
can modify which erase mode appears by default in the drop-down box on the
“Configure” screen’s “System” tab. See Section 5.1.)
c. Select the target destination media from the “Target” drop-down box.
d. Click the Start button. A “Completed” message box will pop up when the
action has finished. Click on the message to continue.
You can view the results of the erasure action by scrolling down to the “System
Log” panel on the “Home” screen. Find and click on the latest link, which will be
denoted by a filename with a date/timestamp format: “S_yyyymmddhhmmss”.
Alternatively, you can click on the Logs button from the top menu bar.
Format After Erase
You can configure the Ditto Shark to automatically format a disk after you erase
it. Make sure that Erase Destination Disk is selected from the “Action to
Perform” drop-down box. Then click on the Configure button. Make sure that
“Format After Erase” is checked for each of the erase modes on which you’d
like to enable this setting. Finally, click OK.
4.2 INVESTIGATION INFO
The Investigation Info panel groups related information that may also be used in
creating custom directories and file names (see Section 5.9). The “Hide” button allows
you to minimize the panel.
Click the Edit button to enter information about the Investigator, Case Number,
Evidence Number, Description, Notes, Base directory prefix, and a Base filename prefix
for a PCAP file.
Each field is filtered to block non-printable ASCII characters. Any characters at the file
system level that may not be safe for a directory name or file name will be filtered out
and replaced with an underscore. Only printable ASCII characters are currently allowed
for directory and filenames. Multiple underscores will also be reduced to a single
underscore per naming item.
The Ditto Shark will generate an error message if you enter a non-printable ASCII char-
acter or if your message exceeds the 58 character limit. Additionally, when the final
directory or filename that uses any of these fields is created, another level of filtering is
applied.
Using apostrophes (‘) in the name fields will cause an error when the file or
folder name is created. They should not be used in the Investigation Info fields.
4.2.1 User Defined Fields
Click on the green plus sign icon to open the “Add User Defined Field” window
(see Figure 11). You may add as many user defined fields as you wish. Each user
defined field must have a title, XML tag, and value. Figure 11. The “Add User Defined Field” window.
STOP!
Figure 9. The “Investigation Info” section.