Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Test
Cases
Description Assertions for Testing
TC-01 Acquire a hard drive using Access Interface (AI) AFR01-05, AFR07,AIC01,
(A11) and convert to an image file
AIC05, ALOG01-03
TC-02 Acquire a digital source that supported by the AFR01-05, AFR07,AIC01,
(A11) tools to an image file
AIC05, ALOG01-03
TC-03 Acquire a hard drive with hidden sectors to an AFR01-07, AIC01-02, AIC05-
(A18) image file
08, ALOG01-03, AHS01-03
TC-04 Acquire a digital source that has at least one AFR01-05, AFR07-09, AIC01-
(A12) faulty data sector
03, AIC05-08, ALOG01-03
TC-05 Acquire a digital source to an image file in an AFR01-05, AFR07, AIC01-02,
(A12) alternate supported format
ALOG01-03
TC-06 Simulate an unresolved read error scenario and AFR01-04, AFR05, AFR07-09,
(A12) check whether the tool notifies and/or try to
recover the error sectors when writing an image
file
AIC01-03, ALOG01-03
TC-07 Attempt to create an image file where destination AFR01-04, AIC04, ALOG01-
(A08) device has insufficient storage space
03
TC-08 Attempt to create an image file where destination AFR01-05, AFR07, AIC01-02,
(A13) device has insufficient storage space, and see AIC04-05, AIC10, ALOG01whether
the tool notifies the user and offer
another destination device to continue
03
TC-09
(A05)
Verify a correct image AFR03, AIC06, ALOG01-03
TC-10 Try verifying a corrupted image AFR03, AIC06-08, ALOG01-
(A06)
03
TC-11 Convert an existing image file to another AFR03, AFR09, ALOG01-03
(A05) supported image file format
TC-12 Acquire a partition that is partially or completely AFR01-07,AIC01-02,AIC05-
(A18) hidden by HPA or DCO
08, ALOG01-03, AHS01-03
TC-13 Acquire a partition that is overlapping with AFR01-05,AFR07, AIC01-02,
(A12) another partition. The end sector of a partition is
ended beyond the starting sector of the next
partition.
AIC11, ALOG01-03
TC-14 Acquire a hard disk with a partition‟s end address AFR01-05,AFR07, AIC01-02,
(A12) ended outside the physical disk boundary. AIC11, ALOG01-03
TC-15 Acquire a hard disk with an unreadable MBR AFR01-05,AFR07-09, AIC01-
(A19)
03, AIC05-08, AIC11,
ALOG01-03
TC-16 Acquire a single GPT partition. AFR01-05, AFR07,AIC01-02,
(A15)
AIC05-08, ALOG01-03
TC-17 Acquire a GPT partition that is partially hidden AFR01-06,AFR07, AIC01-02,
(A19) by HPA
AIC05-08, ALOG01-03,
AHS01-03
TC-18 Verify the network image acquisition function AFR01-05,AFR07, AIC01-02,
(A18) provided by the tool
AIC05-08, ALOG01-03
138