Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Source
Device:
Drive
Setup:
Partition
Table:
Log
highlights:
Results by
assertion:
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
ALOG-03 The tool display correct information regarding to the
acquisition to the user and the information displayed is
consistent with the log file if the log file function is supported
Drive Model: ST380811 AS (80GB)
Serial Number: 6PS2CA4Z
Sector count: 156,296,385
Write blocker: Tableau Forensic SATA/IDE Bridge IEEE 1394 SBP2
Device
Source hashes
MD5 checksum: 2c22fded78dc8ccc2c935944883a2e1b
SHA1 checksum: 10eaa99a609cd8d215c9dc5a68f46e2e0d5c68c5
/dev/sdb: current max LBA: 156,296,385
/dev/sdb: native max LBA: 156,296,385
/dev/sdb: physical max LBA: 156,296,385
/dev/sdb: HPA not set
/dev/sdb: DCO not set
Device Start End #Sectors File System
/dev/sdb1 63 4192964 4192902 NTFS
/dev/sdb2 4193028 6297479 2104452 FAT32
/dev/sdb3 6297543 10490444 4192902 FAT16
/dev/sdb4 10490508 12594959 2104452 Ext2
/dev/sdb5 12595023 14699474 2104452 Ext3
/deb/sdb6 18892503 19149479 256977 Swap
Created By AccessData® FTK® Imager 2.9.0.1385 100406
Starting Sector: 4,193,028
Sector Count: 2,104,452
Source data size: 1027 MB
MD5 checksum: 2c22fded78dc8ccc2c935944883a2e1b
SHA1 checksum: 10eaa99a609cd8d215c9dc5a68f46e2e0d5c68c5
Acquisition started: Tue Jul 27 07:07:32 2010
Acquisition finished: Tue Jul 27 07:08:15 2010
Verification started: Tue Jul 27 07:08:15 2010
Verification finished: Tue Jul 27 07:08:20 2010
MD5 checksum: 2c22fded78dc8ccc2c935944883a2e1b : verified
SHA1 checksum: 10eaa99a609cd8d215c9dc5a68f46e2e0d5c68c5 :
verified
AFR-01 PASSED AIC-01 PASSED
AFR-02 PASSED AIC-05 PASSED
AFR-03 PASSED ALOG-01 PASSED
AFR-04 PASSED ALOG-02 PASSED
AFR-05 PASSED ALOG-03 PASSED
AFR-07 PASSED
Analysis: Test achieved the expected Result. Source hashes match verification
hashes.
166