Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Table 4.13
TC-13 Result Summary
Tested
Assertions
Failed
Assertions
Pass Rate
(%)
FTK Imager Helix 3 Pro AIR
AFR01-05, AFR07, AIC01-02, AIC11, ALOG01-03
AIC11 AIC11, ALOG02 AIC11
91.67% 83.33% 91.67%
Helix 3 pro was unable to recover the partition table and the irregularity of the
partition table was not reported to the user. However, all the data were acquired
correctly and completely.
AIR failed to report to the user that irregularities were detected in the digital
source. However, all the data were acquired correctly and completely.
4.2.2.12 TC-14: Partition Out Of Physical Boundary
Test case TC-14 involved testing whether the disk imaging tools were capable to
acquire a partition whose end address was outside the physical boundary. The end
address of a partition was set to 156,350,047 but the physical boundary of the drive
was 156,301,488. Table 4.14 shows the test results of test case TC-14.
Table 4.14
TC-14 Result Summary
Tested
Assertions
Failed
Assertions
Pass Rate
(%)
FTK Imager Helix 3 Pro AIR
AFR01-05, AFR07, AIC01-02, AIC11, ALOG01-03
AIC11 AIC11, ALOG02 AIC11
91.67% 83.33% 91.67%
FTK Imager was able to recover the partition table and display the correct partition
information to the user. All the data acquired were correct and complete. However, the
fact that the partition ended outside the physical boundary was not reported to the user.
83