Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Helix 3 Pro was not able to read the partition table information from the test drive.
However, all the data acquired were correct and complete. The source hash values
matched the verification hash values. AIR achieved the expected result in this test
case. AIR acquired the GPT disk successfully and produced accurate and complete
image files.
4.2.2.16 TC-17: Acquiring a partially hidden GPT Partition
Test case TC-17 was involved testing whether the disk imaging tools were able to
acquire a single GUID partition that was partially hidden through using HPA
configuration. The result summary is shown in Table 4.18. The results were similar to
those in the test case TC-12(1). All three evaluated tools failed to detect and acquire
hidden sectors that existed in the test drive. However, the visible data sectors were all
acquired completely and accurately.
Table 4.18
TC-17 Result Summary
Tested
Assertions
Failed
Assertions
Pass Rate
(%)
FTK Imager Helix 3 Pro AIR
AFR01-06,AFR07, AIC01-02, AIC05-08, ALOG01-03, AHS01-03
AFR-06, AHS01-03
AFR-06, AHS01-03
ALOG02
86
AFR-06, AHS01-03
78.95% 73.68% 78.95%
FTK Imager reported that the block index was out of bound instead of the partition
was partially hidden. Helix 3 Pro was not able to recognise the GUID partition. AIR
was able to acquire all the visible data sectors completely and accurately.
4.2.2.17 TC-18: Acquiring Single Partition Using Local Network Connection
Test case TC-18 involved testing if the tools were able to produce complete and
accurate images and to transfer them over a locally connected network. Table 4.19
shows a summary of the performance of the three tested tools. This test case only