Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

six GUID partitions were created. The testing was meant to acquire partition 4 as a
NTFS partition. Table 4.16 shows the test results of test case TC-16(1).
Table 4.16
TC-16(1) Result Summary
Tested
Assertions
Failed
Assertions
FTK Imager Helix 3 Pro AIR
AFR01-05, AFR07, AIC01-02, AIC05-08, ALOG01-03
None
AFR-01 & 03 Passed
AFR-02 FAILED
Others are N/A
85
None
Pass Rate (%) 100% 33.33% 100%
FTK Imager was able to read the partition information from the test drive and to
display it correctly to the user. All data acquired for the NTFS partition were correct
and complete. Helix 3 Pro was not able to identify the six pre-configured GUID
partitions in the test drive. Only the whole drive acquisition option was available. AIR
achieved the expected result in this test case. AIR acquired the single GUID partition
successfully and the images produced were complete and accurate.
4.2.2.15 TC-16(2): Acquiring A GPT Disk
The pervious test case TC-16(1) tested if the imaging tools were able to acquire a
single GUID partition. The test case TC-16(2) tested if the tested tools could acquire a
whole GPT disk. FTK Imager displayed to the user the correct partition information of
the test drive and all data acquired were correct and complete.
Table 4.17
TC-16(2) Result Summary
Tested
Assertions
Failed
Assertions
Pass Rate
(%)
FTK Imager Helix 3 Pro AIR
AFR01-05, AFR07, AIC01-02, AIC05-08, ALOG01-03
None ALOG02 None
100% 93.33% 100%