Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Log
highlights:
Results by
assertion:
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
Created By AccessData® FTK® Imager 2.9.0.1385 100406
Starting Sector: 12,595,023
Sector Count: 2,104,452
Source data size: 1027 MB
Sector count: 2104452
MD5 checksum: f7c2c38630b0c995732a87cce003dcca
SHA1 checksum: 2043d334ef1ee9c1749427b249b3c983d4fcc8ed
Acquisition started: Wed Aug 11 03:37:58 2010
Acquisition finished: Wed Aug 11 03:38:41 2010
Verification started: Wed Aug 11 03:38:41 2010
Verification finished: Wed Aug 11 03:38:58 2010
MD5 checksum: f7c2c38630b0c995732a87cce003dcca : verified
SHA1 checksum: 2043d334ef1ee9c1749427b249b3c983d4fcc8ed :
verified
AFR-01 PASSED
AFR-02 PASSED
AFR-03 PASSED
AFR-04 PASSED
AFR-05 PASSED
AFR-07 PASSED
AIC-01 PASSED
AIC-02 PASSED
ALOG-01 PASSED
ALOG-02 PASSED
ALOG-03 PASSED
Analysis: Test achieved the expected Result. Source hashes match verification
hashes and the hash of the original DD image.
1.15 TC-05-E01
Test Case TC-05-E01 (FTK Imager 2.9.0.1385)
Test &
Case
Summary:
Acquire a digital source to an image file in an alternate supported format
Notes: Acquire image to E01 format image format
Assertion: AFR-01 The tool accesses the digital source with a supported access
interface
AFR-02 The tool acquires a digital source
AFR-03 The tool operates in an execution environment
AFR-04 The tool creates an image file of the digital source
AFR-05 The tool acquires all the visible data sectors from the digital
source
AFR-07 All data sectors acquired from the digital source are acquired
accurately.
AIC-01 The data represented by an image file is the same as the data
acquired by the tool.
AIC-02 The tool creates an image file according to the file format the
user specified.
ALOG-01 If the tool logs any information regarding to the acquisition,
the information is accurately logged in the log file.
ALOG-02 The tool display correct information about the acquisition to
the user.
179