Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

information of the total number of sectors that had been acquired by calculating the
size and number of image files generated by the tool and converting it to the sector.
The calculation is beyond the scope of this research. The tool is able to obtain the
information when acquiring the digital source but choosing whether to record the
information in the log file was the choice of the tool. The information is important for
the forensic investigators. With more relevant information provided by the disk
imaging tools, forensic investigator will have more chance to locate and capture
crucial information from the digital evidence.
Helix 3 Pro supports EnCase version 4, 5 and 6 as alternative disk image
formats besides raw image format. Helix 3 Pro successfully acquired the digital source
to EnCase version 6 format during the testing. However, the log file that Helix 3 Pro
generated did not clearly state that verification had been performed like the log file
generated in raw image format. The hash value was only calculated over the acquired
data but not on the digital source. The user could not ascertain whether the acquired
data was a bit-by-bit copy of the digital source. Forensic investigators may rely on the
log file generated as part of the evidence or audit trails by the tool. Users may be
required to take extra steps to verify the hash values of both acquired and source data.
It is not a major flaw of the software because when the tool acquiring the source to
image files, both hash values could be calculated. The tool should clearly indicate that
integrity has been verified on both acquired and digital source.
Helix 3 Pro failed to acquire hidden sectors configured in cases where HPA or
DCO setting was used. The fact that FTK Imager and AIR imaging tools also failed in
the same test should be noted. In the test case where Helix 3 Pro acquired hidden
areas, it was not able to obtain the partition table information of the hard disk whereas
the other two tools were able to perform this task. Helix 3 Pro‟s performance was
unsatisfactory in the test case TC-12 where partially and completely hidden partitions
were involved. Helix 3 Pro was not able to complete the acquisition process within a
reasonable timeframe. The tool acquired the digital source at an extremely slow speed
when it encountered the hidden partition. The tool was attempting to access the hidden
data in the same way as FTK Imager in the same case. Appropriate error message
should have issued to notify the user of the situation when an excessive amount of
102