Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Log
highlights:
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
/dev/sdb3 94863825 156296384 61432560 NTFS
(DCO)
Created By AccessData® FTK® Imager 2.9.0.1385 100406
Cylinders: 5,905
Tracks per Cylinder: 255
Sectors per Track: 63
Bytes per Sector: 512
Sector Count: 94,868,928
Drive Model: ST380817AS ATA Device
Drive Serial Number: 5MR18V18
Drive Interface Type: IDE
Source data size: 46322 MB
Sector count: 94868928
MD5 checksum: 69fdef5d5de3a207bc2a04017c38c3fd
SHA1 checksum: 9d768ab184ed9a172031f0f7b7f721f2bdf80b59
Acquisition started: Mon Jul 26 20:00:03 2010
Acquisition finished: Mon Jul 26 20:16:17 2010
Segment list:
H:\new\FTK_test003_DCO_ST380817AS.001
H:\new\FTK_test003_DCO_ST380817AS.002
………………………………
H:\new\FTK_test003_DCO_ST380817AS.031
Verification started: Mon Jul 26 20:16:17 2010
Verification finished: Mon Jul 26 20:23:58 2010
MD5 checksum: 69fdef5d5de3a207bc2a04017c38c3fd : verified
SHA1 checksum: 9d768ab184ed9a172031f0f7b7f721f2bdf80b59 : verified
Results by
assertion: AFR-01 PASSED AIC-01 PASSED AHS-02 FAILED
AFR-02 PASSED AIC-02 PASSED AHS-03 FAILED
AFR-03 PASSED AIC-05 PASSED ALOG-01 PASSED
AFR-04 PASSED AIC-06 PASSED ALOG-02 PASSED
AFR-05 PASSED AIC-07 PASSED ALOG-03 PASSED
AFR-06 FAILED AIC-08 PASSED
AFR-07 PASSED AHS-01 FAILED
Analysis: Test FAILED to achieve the expected Result. FTK Imager failed to detect
and acquire the hidden areas in the hard drive.
During the acquisition process, FTK Imager encountered an unexpected error
twice and the debugging information is also provided by FTK Imager.
175