Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

tools. For instance, the test case TC-04 could not be performed because the tools that
could manipulate a faulty data sector were not available.
5.1.1 Disk Imaging Tools Testing Procedures
The disk imaging tool testing procedures are summarised in Table 5.1. The first step
needed to reset the test drive at the beginning to ensure that no data from previous use
still remained in the hard drive. Normal reformatting of the storage device does not
guarantee that all the data in the device are completely removed. A program called
Darik's Boot and Nuke were used in order to wipe the test drive securely to a clean
state.
The second step of the tool evaluation procedure was the configuration of the
test drive. After the configuring the test drive to the appropriate test state, the entire
drive was hashed with the utilisation of EnCase and the computed hash values (MD5
and SHA1) were considered as source hashes. Hardware write blocker was used after
the source hashes had been computed. This tactic ensured that no change would be
made on the test drive after they had been configured to the proper testing state. In
some cases, SHA512 could be used instead of SHA1 and this should not affect the end
result. The concern in this procedure was that hashing was not computed for the entire
drive in the HPA or DCO active test drives. Only the accessible areas were hashed.
The removal of the HPA or DCO active areas was inconsistent with the testing
purpose of the test. Standardised forensic procedures were followed when the test
drive was acquired or imaged. Segmented image files were generated and stored in the
designated destination. The hardware write blocker was utilised consistently with pre-
specified test cases as the exception (to prevent any tampering of the test drive).
Hashes were calculated after every acquisition and the acquisition logs were properly
stored and documented.
Step 4 was specifically designed in this research to verify the accuracy of the
acquired images. The hash values of the acquired images were verified again by the
use of EnCase to assure that the values generated by the disk imaging tools were
accurate.
98