Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Source
Device:
Drive
Setup:
Partition
Table:
Log
highlights:
Results by
assertion:
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
Drive Model: ST380817AS (80GB)
Serial Number: 5MR18V18
Sector count: 156,301,488
Write blocker: Tableau Forensic SATA/IDE Bridge IEEE 1394 SBP2
Device
Source hashes
md5: d8235a6c57ddf91c902d42f0e39cb7d5
sha1: b91e9115388276b961e6a94a6322337048734d6c
/dev/sda: current max LBA: 156,301,488
/dev/sda: native max LBA: 156,301,488
/dev/sda: physical max LBA: 156,301,488
/dev/sda: HPA not set
/dev/sda: DCO not set
Device Start End #sectors File System Size
/dev/sdb1 4096 4198399 4194304 HFS 2Gb
/dev/sdb2 4198400 14999551 10801152 HFS+ 5Gb
Unallocated
Created By AccessData® FTK® Imager 2.9.0.1385 100406
Starting Sector: 4,096
Sector Count: 4,194,304
Source data size: 2048 MB
Sector count: 4194304
[Computed Hashes]
MD5 checksum: d8235a6c57ddf91c902d42f0e39cb7d5
SHA1 checksum: b91e9115388276b961e6a94a6322337048734d6c
Segment list:
E:\Image\FTK_HFS.001
E:\Image\FTK_HFS.002
Acquisition started: Sun Oct 03 10:18:17 2010
Acquisition finished: Sun Oct 03 10:19:38 2010
Verification started: Sun Oct 03 10:19:38 2010
Verification finished: Sun Oct 03 10:20:07 2010
MD5 checksum: d8235a6c57ddf91c902d42f0e39cb7d5 : verified
SHA1 checksum: b91e9115388276b961e6a94a6322337048734d6c :
verified
AFR-01 PASSED AIC-01 PASSED
AFR-02 PASSED AIC-05 PASSED
AFR-03 PASSED ALOG-01 PASSED
AFR-04 PASSED ALOG-02 PASSED
AFR-05 PASSED ALOG-03 PASSED
AFR-07 PASSED
Analysis: Test achieved the expected Result. Source hashes match verification
hashes.
169