Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
SHA1 checksum: 82d4b6226995d11b82979db901e809a06b1574e8 :
verified
Results by AFR-01 PASSED AIC-01 PASSED
assertion: AFR-02 PASSED AIC-05 PASSED
AFR-03 PASSED ALOG-01 PASSED
AFR-04 PASSED ALOG-02 PASSED
AFR-05 PASSED ALOG-03 PASSED
AFR-07 PASSED
Analysis: Test achieved the expected Result. Source hashes match verification
hashes.
1.2 TC-01-USB
Test Case TC-01-USB (FTK Imager 2.9.0.1385)
Test &
Case
Summary:
TC-01 Acquire a hard drive using Access Interface (AI) and convert to an
image file
Assertions: AFR-01 The tool accesses the digital source with a supported access
interface
AFR-02 The tool acquires a digital source
AFR-03 The tool operates in an execution environment
AFR-04 The tool creates an image file of the digital source
AFR-05 The tool acquires all the visible data sectors from the digital
source
AFR-07 All data sectors acquired from the digital source are acquired
accurately.
AIC-01 The data represented by an image file is the same as the data
acquired by the tool
AIC-05 If multi-file image creation and the image file size is selected,
the tool creates a multi-file image except that one file may be
smaller
ALOG-01 If the tool logs any information regarding to the acquisition,
the information is accurately logged in the log file.
ALOG-02 The tool display correct information about the acquisition to
the user.
ALOG-03 The tool display correct information regarding to the
acquisition to the user and the information displayed is
Source
Device:
Drive
Setup:
consistent with the log file if the log file function is supported
Drive Model: USB 2.0 Drive (4GB)
Serial Number: N/A
Sector count: 7,987,200
Write blocker: N/A
Source hashes
MD5 checksum: fcf954774adec1eefb4b873b3c8f3612
SHA1 checksum: 033772e928aea0c52827574cfb2c7f020062aa84
/dev/sda: current max LBA: 7,987,200
/dev/sda: native max LBA: 7,987,200
/dev/sda: physical max LBA: 7,987,200
158