Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Assertions for Fundamental Requirements
Assertion ID Assertion Description
TSP-AFR-
01
TSP-AFR-
02
TSP-AFR-
03
TSP-AFR-
04
TSP-AFR-
05
TSP-AFR-
06
TSP-AFR-
07
TSP-AFR-
08
TSP-AFR-
09
The tool accesses the digital source with a supported
access interface
The tool acquires a digital source
The tool operates in an execution environment
The tool creates an image file of the digital source
The tool acquires all the visible data sectors from
the digital source
The tool acquires all the hidden data sectors from
the digital source
All data sectors acquired from the digital source are
acquired accurately.
The tool reports to the user of the error type and the
location of the error if error occurred during the
reading from a digital source.
If there are unresolved errors reading from a digital
source, then the tool uses a benign fill in the
destination object in place of the inaccessible data.
Assertions for Optional Features - Logging Function (LOG)
Assertion ID Assertion Description
TSP-ALOG-
01
TSP-ALOG-
02
TSP-ALOG-
03
If the tool logs any information regarding to the
acquisition, the information is accurately logged in
the log file.
The tool display correct information about the
acquisition to the user. The information about the
acquisition at least including following: device
name & serial, start sector, end sector, type and
number of errors encountered, and start time and
end time of acquisition.
The acquisition information displayed to the user is
consistent with the log file if the log file function is
supported
140
Correspondent
NIST Assertion
DA-AM-01
DA-AM-02
DA-AM-03
DA-AM-05
DA-AM-06
DA-AM-07
DA-AM-08
DA-AM-09
DA-AM-10
Correspondent
NIST Assertion
DA-AO-23
SKL-DIA-25
N/A