Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

7. Keep setting “noerror, sync” as Conversion.
8. Click start to start the acquisition
9. Wait until AIR indicates the acquisition progress is completed.
10. Save the Log file to an external drive as backup.
4.2 Acquisition – Helix 3 Pro
This procedure outlines the process of a disk imaging acquisition of the tool Helix 3
Pro.
4.7.1 Prerequisites
1. CD/DVD drive is properly setup and ready to use
2. Windows XP Professional with Service Pack 3 is installed in the system or
Windows 7 with latest system updates installed
3. Minimum data storage requirement for the program is met
4.7.2 Acquisition – Helix 3 Pro (Common in most Test Scenarios)
1. Connect the test hard drive to the Windows machine using the specified physical
interface. Connect to the hardware writeblocker if the test case is required.
2. Boot from the Helix 3 Pro Live CD or start Helix 3 from the Windows
environment
3. Run Helix 3
4. Choose the Source drive or partition from the device list.
5. Click Acquire tab
a) Select the output type (Usually is RAW format but EnCase format is
used in certain test cases)
b) Input Case name, Examiner, Case Number, Item number, Description
and Notes
c) Choose 2GB default segmentation and Read Size 32768
d) Select MD5 and SHA1 as hash protocol
e) Select destination drive
f) Start the acquisition
g) Wait until Helix 3 Pro indicates the acquisition progress is completed.
4.3 Verification of Acquired Image (Common in most Test Scenarios)
148