Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

inconsistent with what is stated in the user manual. FTK Imager cannot handle hidden
areas (either HPA or DCO or the combination of both) when acquiring the entire test
drive. FTK Imager provides no notification to the user about whether hidden areas are
present or not. When the FTK Imager acquires a partition that has been partially
hidden, it displays and logs that the error “Block Indexes Out of Bounds” instead of
detecting and disclosing hidden areas. However, the acquisition of completely hidden
partition is not successful and the software freezes at the stage “Preparing to Image”.
The program crashes as well when it attempts to create the directory listings for the
hidden partition. Irregular configurations are not detected and notified by the FTK
Imager.
Helix 3 Pro presents some noteworthy problems during the testing. The amount
of data it has acquired is not reported as defined in the research specifications. Users
must manually calculate the number and size of the generated image files. The tool
should have captured at information during the testing. The size of the total acquired
data is considered significant for disk imaging tools. Helix 3 Pro does not clearly state
whether the image files have been verified when the test drive is transformed into
EnCase image format. Extra verification measures may be required to verify the
integrity of the image files again. Similarly to FTK Imager, Helix 3 Pro cannot handle
HPA and/or DCO hidden areas. When acquiring partially and completely hidden
partitions, Helix 3 Pro performs inconsistently. The disk imaging proceeds at a
remarkably slow speed and the process has to be terminated because it does not finish
within a reasonable timeframe. In the test case where UNC errors exist, Helix 3 Pro
does not record types and locations of the errors and the inaccessible sectors are
replaced by a pre-configured value without details being disclosed clearly in the log
file and in the user manual. The network acquisition function of Helix 3 Pro is
unstable in Windows environments. Unhandled software exceptions and program
crashes are observed during the testing. Some usability problems of the program are
also discerned, such as lethargic progress bar, no indication of overall imaging
progress and of overall progress on the sender side of network acquisition. Finally,
GUID partition type is not supported by the software.
116