Skip to content

Acquisition Log Sample

Every acquisition performed by LLIMAGER-win — Disk Image, Targeted Collection, or a Dead Box acquisition via LLIMAGER Linux — as well as Convert/Hash and Verify & Anchor Images operations, concludes with a PDF-based report saved to the destination disk. The PDF is cryptographically signed and sealed, and (for acquisition logs) embedded with a unique QR code used by the LLSmartVerify add-on. Scanning this QR code with the LLIMAGER Companion mobile app registers the evidence and anchors its salted hash to an immutable blockchain via the LLSmartVerify Portal. The report's key metadata can be validated by third parties using the mobile app or a copy of the PDF report.

Report Types

Depending on which module was used, the report layout and content differ slightly:

  • Disk Image / Targeted Collection / Dead Box — an acquisition log containing case metadata, device/source information, destination and output format, hash value(s), timestamps, and an embedded QR code for LLSmartVerify registration.
  • Convert/Hash (Hash Files) — a hashing report listing every file/folder hashed, individual and aggregate hash values, and a companion CSV file with per-item results.
  • Convert/Hash (Convert DD→E01) — a conversion report documenting the source file, output E01 path, compression, segment size, and resulting hash value.
  • Sent to Cloud — A transfer report documenting the keys used (masked), the bucket, the size of files or folders transferred and the corresponding timestamps. The report varies accordingly to the cloud used (AWS, GCP, Azure).
  • Verify & Anchor Images — a verification report documenting the E01's embedded metadata, the stored hash, the freshly computed hash, and the verification outcome (verified, mismatch, or no stored hash found).