Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Source
Device:
Drive
Setup:
Partition
Table:
Log
highlights:
AHS-02
AHS-03
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
The tool reports to the user that digital source may contain hidden sector but
undetected if the tool is unable to determine whether hidden sectors are
present due to incompatible execution environment
The tool reports to the user that hidden sectors will not be acquired if the tool
is unable to acquire hidden sectors due to incompatible execution
environment
Drive Model: ST380817AS (80GB)
Serial Number: 5MR18V18
Sector count: 156,301,488
Write blocker: N/A
Source hashes
MD5 checksum: 69fdef5d5de3a207bc2a04017c38c3fd
SHA1 checksum: 9d768ab184ed9a172031f0f7b7f721f2bdf80b59
/dev/sdb: current max LBA: 94,863,827
/dev/sdb: native max LBA: 94,863,827
/dev/sdb: physical max LBA: 156,301,487
/dev/sdb: HPA set from sector 94,863,828 to 156,301,487
/dev/sdb: DCO not set
Device Start End #sectors File System
/dev/sdb1 63 41945714 41945652 NTFS
/dev/sdb2 41945715 94863824 52918110 Ext3
/dev/sdb3 94863825 156296384 61432560 NTFS (HPA)
Created By AccessData® FTK® Imager 2.9.0.1385 100406
Cylinders: 5,905
Sectors per Track: 63
Bytes per Sector: 512
Sector Count: 94,868,928
Drive Model: ST380817AS ATA Device
Drive Serial Number: 5MR18V18
Drive Interface Type: IDE
Source data size: 46322 MB
Sector count: 94,868,928
MD5 checksum: 69fdef5d5de3a207bc2a04017c38c3fd
SHA1 checksum: 9d768ab184ed9a172031f0f7b7f721f2bdf80b59
Acquisition started: Thu Jul 22 12:22:59 2010
Acquisition finished: Thu Jul 22 12:42:25 2010
E:\Image\test003_HPA_ST380817AS.001
……………………..
E:\Image\test003_HPA_ST380817AS.031
Verification started: Thu Jul 22 12:50:44 2010
Verification finished: Thu Jul 22 12:59:01 2010
MD5 checksum: 69fdef5d5de3a207bc2a04017c38c3fd : verified
SHA1 checksum: 9d768ab184ed9a172031f0f7b7f721f2bdf80b59 : verified
172