Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Results by
assertion:
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
AFR-01 PASSED
AFR-02 PASSED
AFR-03 PASSED
AFR-04 PASSED
AFR-05 PASSED
AFR-07 PASSED
AIC-01 PASSED
AIC-02 PASSED
ALOG-01 PASSED
ALOG-02 PASSED
ALOG-03 PASSED
Analysis: Test achieved the expected Result. Source hashes match verification
hashes and the hash of the original DD image.
1.16 TC-06-UNC
Test Case TC-06-UNC (FTK Imager 2.9.0.1385)
Test &
Case
Summary:
Acquire a digital source that has at least one faulty data sector
Notes: 15 UNC errors existed
Assertion: AFR-01 The tool accesses the digital source with a supported access interface
AFR-02 The tool acquires a digital source
AFR-03 The tool operates in an execution environment
AFR-04 The tool creates an image file of the digital source
AFR-05 The tool acquires all the visible data sectors from the digital source
AFR-07 All data sectors acquired from the digital source are acquired accurately.
AFR-08
The tool report to the user of the error type and the location of the error if
error occurred during the reading from a digital source.
AFR-09
If there are unresolved errors reading from a digital source, then the tool
uses a benign fill in the destination object in place of the inaccessible data.
AIC-01
The data represented by an image file is the same as the data acquired by
the tool
AIC-02
The tool creates an image file according to the file format the user
specified.
AIC-03
The tool reports to the user if an error occurs during the image creation
Source
Device:
AIC-06
AIC-07
AIC-08
ALOG-01
process.
If the image file integrity check is selected, the tool shall report to the user
the image file has not been changed if the image file has not been
changed.
If the image file integrity check is selected, the tool shall report to the user
the image file has been changed if the image file has been changed.
If the image file integrity check is selected, the tool shall report to the user
the image file has been changed and the involved location if the image file
has been changed.
If the tool logs any information regarding to the acquisition, the
information is accurately logged in the log file.
ALOG-02 The tool display correct information about the acquisition to the user.
ALOG-03
The tool display correct information regarding to the acquisition to the
user and the information displayed is consistent with the log file if the log
file function is supported
Drive Model: ST380817AS (80GB)
Serial Number: 5MR18V18
Sector count: 156,301,488
Write blocker: Tableau Forensic SATA/IDE Bridge IEEE 1394 SBP2
Device
181