IMSolo-IV Forensic LinkMASSter-NET Quick Start Guide - ICS-IQ.com

8.Verify all remaining applicable settings and optionally enter Case Informationusing the CASE INFO screen functions (See Table 1 and 2). It isrecommended to enable the Hash Targets function. Selecting Hash Targetswill result in the Capture operation generating the Hash value for the dataread from the Suspect drive and the data written to the Evidence drive. Afterall the data is written to the Evidence drive, the Capture operation willgenerate the Hash value for the data read from the Evidence drive.9.Hash values generated during the capture operation are generatedfor the data read from the Suspect’s drive not from the data read fromthe Evidence (target) drive, unless the unit is instructed to hash theEvidence drive(s) by enabling the Hash Targets function. As analternative, the Evidence Drives can also be hashed after the captureoperation using the Hash mode of operation.Connect the ICS supplied Crossover Ethernet Cable to the IMSolo-IV unit’sEthernet port and to the Notebook/PC Ethernet port. Alternately, connect theGigabit USB-to-Ethernet Network Adapter to the Notebook/PC USB port andthe Ethernet Cable connector end to the IMSolo-IV unit’s Ethernet port. Seethe inst ructions below titled “USB-to-Ethernet Connection”, for additionaldetails.10. Configure the Suspect’s PC or Notebook BIOS to boot from its CD-ROM orDVD drive. Most BIOS have a section titled “Boot Order” to perform thisfunction.NOTE:Various PC or Notebook BIOS require deferent key combinations atboot up to change the default Boot Order. It is the user’sresponsibility to correctly setup the Suspect’s PC or Notebook BIOS.11. Insert the LinkMASSter Bootable CD and allow the Suspect’s PC or Notebookto boot from the LinkMASSter CD.12. After “Initializing the Environment”, the LinkMASSter application will display aprompt indicating “Do you want to prepare a USB Flash?” Select “NO” tocontinue.13. The LinkMASSter Network Capture Agent Screen is display with thecomputer’s detected drive information.14. Select Detect Drives from the IMSolo-IV Forensics Advanced InterfaceControl Console screen. The Suspect drive, located in the Suspect’scomputer, will be listed in the Source Drive panel list and the Evidence drivewill be listed in the Destination Drives panel list.15. Select START to begin the operation.Operational status information will bedisplayed during an operation.