Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Source
Device:
Drive
Setup:
Log
highlights:
Results by
assertion:
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
selected, the tool creates a multi-file image except that one
file may be smaller
ALOG-01 If the tool logs any information regarding to the acquisition,
the information is accurately logged in the log file.
ALOG-02 The tool display correct information about the acquisition to
the user.
ALOG-03 The tool display correct information regarding to the
acquisition to the user and the information displayed is
consistent with the log file if the log file function is
supported
Drive Model: ST380817AS (80GB)
Serial Number: 5MR18V18
Sector count: 156,301,488
Write blocker: Tableau Forensic SATA/IDE Bridge IEEE 1394 SBP2
Device
Source hashes
MD5 checksum: 436a043c1766f46f3945e605144f22eb
SHA1 checksum: 82d4b6226995d11b82979db901e809a06b1574e8
/dev/sda: current max LBA: 156,301,488
/dev/sda: native max LBA: 156,301,488
/dev/sda: physical max LBA: 156,301,488
/dev/sda: HPA not set
/dev/sda: DCO not set
Created By AccessData® FTK® Imager 2.9.0.1385 100406
Source data size: 76319 MB
Sector count: 156301488
MD5 checksum: 436a043c1766f46f3945e605144f22eb
SHA1 checksum: 82d4b6226995d11b82979db901e809a06b1574e8
Acquisition started: Mon Jun 28 00:16:23 2010
Acquisition finished: Mon Jun 28 01:07:57 2010
Verification started: Mon Jun 28 01:07:57 2010
Verification finished: Mon Jun 28 01:24:05 2010
MD5 checksum: 436a043c1766f46f3945e605144f22eb : verified
SHA1 checksum: 82d4b6226995d11b82979db901e809a06b1574e8 :
verified
AFR-01 PASSED AIC-01 PASSED
AFR-02 PASSED AIC-05 PASSED
AFR-03 PASSED ALOG-01 PASSED
AFR-04 PASSED ALOG-02 PASSED
AFR-05 PASSED ALOG-03 PASSED
AFR-07 PASSED
Analysis: Test achieved the expected Result. Source hashes match verification
hashes.
160