30.06.2013 Views

Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

1.14 TC-05-Smart<br />

FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)<br />

Test Case TC-05-Smart (FTK Imager 2.9.0.1385)<br />

Test &<br />

Case<br />

Summary:<br />

Acquire a digital source to an image file in an alternate supported <strong>for</strong>mat<br />

Notes: Acquire image to Smart image <strong>for</strong>mat<br />

Assertion: AFR-01 The tool accesses the digital source with a supported access<br />

interface<br />

AFR-02 The tool acquires a digital source<br />

AFR-03 The tool operates in an execution environment<br />

AFR-04 The tool creates an image file <strong>of</strong> the digital source<br />

AFR-05 The tool acquires all the visible data sectors from the digital<br />

source<br />

AFR-07 All data sectors acquired from the digital source are acquired<br />

accurately.<br />

AIC-01 The data represented by an image file is the same as the data<br />

acquired by the tool.<br />

AIC-02 The tool creates an image file according to the file <strong>for</strong>mat the<br />

user specified.<br />

ALOG-01 If the tool logs any in<strong>for</strong>mation regarding to the acquisition, the<br />

in<strong>for</strong>mation is accurately logged in the log file.<br />

ALOG-02 The tool display correct in<strong>for</strong>mation about the acquisition to<br />

the user.<br />

ALOG-03 The tool display correct in<strong>for</strong>mation regarding to the<br />

acquisition to the user and the in<strong>for</strong>mation displayed is<br />

Source<br />

Device:<br />

Drive<br />

Setup:<br />

Partition<br />

Setup:<br />

consistent with the log file if the log file function is supported<br />

Drive Model: ST380811 AS (80GB)<br />

Serial Number: 6PS2CA4Z<br />

Sector count: 156,296,385<br />

Write blocker: Tableau <strong>Forensic</strong> SATA/IDE Bridge IEEE 1394 SBP2<br />

Device<br />

Source hashes<br />

MD5 checksum: f7c2c38630b0c995732a87cce003dcca<br />

SHA1 checksum: 2043d334ef1ee9c1749427b249b3c983d4fcc8ed<br />

Total sectors: 2104452 (1024MB)<br />

/dev/sda: current max LBA: 156,296,385<br />

/dev/sda: native max LBA: 156,296,385<br />

/dev/sda: physical max LBA: 156,296,385<br />

/dev/sda: HPA not set<br />

/dev/sda: DCO not set<br />

Device Start End #Sectors File System<br />

/dev/sda1 63 41945714 41945652 HPFS/NTFS<br />

/dev/sda2 4192965 156296384 152103420 Extended<br />

/dev/sda5 4193028 6297479 2104452 FAT32<br />

/dev/sda6 6297543 10490444 4192902 FAT16<br />

/dev/sda7 10490508 12594959 1052226 Ext2<br />

/dev/sda8 12595023 14699474 2104452 Ext3<br />

/dev/sda9 14699538 18892439 4192902 HPFS/NTFS<br />

/dev/sda10<br />

unallocated<br />

18892503<br />

19149480<br />

19149479<br />

156296384<br />

256977<br />

137146905<br />

Swap<br />

Empty<br />

178

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!