Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Helix 3 pro was unable to recover the partition table and the fact that the partition
ended outside the physical boundary was not reported to the user. However, the data
acquired were complete and accurate.
AIR failed to report to the user the irregularities in the digital source. However,
the data acquired were complete and accurate.
4.2.2.13 TC-15: Acquiring A Hard Drive With A Unreadable MBR
Test case TC-15 involved testing whether the disk imaging tools were able to acquire
the test drive with unreadable Master Boot Record (MBR). The entire 512 byte boot
sectors were replaced by value 0. Table 4.15 shows the test results of test case TC-15.
FTK Imager was not able to recognise the partition table existed in the device.
The entire device was recognised as unallocated space. The irregularity in the MBR
was not reported to the user. However, all the data acquired were complete and
accurate.
Table 4.15
TC-15 Result Summary
Tested
Assertions
Failed
Assertions
Pass Rate
(%)
FTK Imager Helix 3 Pro AIR
AFR01-05, AFR07-09, AIC01-02, AIC05-08, AIC11, ALOG01-03
AIC11, ALOG02 AIC11, ALOG02 AIC11
88.89% 88.89% 94.44%
Helix 3 Pro was not able to recognise the partition table in the device. However, all the
data acquired were complete and accurate. The irregularity of the MBR was not
reported to the user. AIR was able to acquire all the data in a completed and accurate
manner. However, the irregularity of the MBR was not reported to the user.
4.2.2.14 TC-16(1): Acquiring A Single GUID Partition
Test case TC-16(1) involved testing whether the disk imaging tools were able to
acquire a single GUID partition. The entire hard drive was created as a GPT disk and
84