Double-clicking on the info file in the Image directory location allows us to inspect a variety of details about the acquisition process from start to completion, including the hashed outputs.

This info file contains much more data than the log file produced by DC3DD, including the case management details:

Let's have a closer look at the hash details within the .info file.

We can see that the MD5 and SHA-1 hashes have been created and verified and, as stated in the last line of the following screenshot, Image verification OK. The image contains exactly the data that was written:

If we compare these hashes with the ones created using DC3DD, we would have the exact same MD5 and SHA-1 outputs, proving that these images are exact forensic copies of the original evidence.

Compare the hashes in the following screenshots, created by DC3DD, with the ones in the previous screenshots, created by Guymager:

• DC3DD MD5 Hash:

• DC3DD SHA-1 Hash: