Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Drive
Setup:
Log
highlights:
Results by
assertion:
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
/dev/sdb: current max LBA: 156,301,488
/dev/sdb: native max LBA: 156,301,488
/dev/sdb: physical max LBA: 156,301,488
/dev/sdb: HPA not set
/dev/sdb: DCO not set
Faulty sectors marked:
5161564, 12135645, 16429701, 28210195, 33486075, 40694940, 40828560,
57691700, 90179820, 91800252, 92763320, 104129017, 109477200,
118026966, 140386491
Created By AccessData® FTK® Imager 2.9.0.1385 100406
Cylinders: 9,729
Tracks per Cylinder: 255
Sectors per Track: 63
Bytes per Sector: 512
Sector Count: 156,301,488
Drive Serial Number: 02cc0e0010903500
Drive Interface Type: 1394
Source data size: 76319 MB
Sector count: 156301488
ATTENTION:
The following sector(s) on the source drive could not be read:
5161564, 12135645, 16429701, 28210195, 33486075, 40694940, 40828560,
57691700, 90179820, 91800252, 92763320, 104129017, 109477200,
118026966, 140386491
The contents of these sectors were replaced with zeros in the image.
Checked - Zero filled into the 15 sectors that FTK imager could not read.
MD5 checksum: 1b26c0e62b79f528793199a3d2de4034
SHA1 checksum: 52bafa6d754870b33cb85089ae89538c9355844c
Acquisition started: Thu Aug 05 23:50:45 2010
Acquisition finished: Fri Aug 06 00:44:31 2010
Segment list:
E:\Image\Test-UNC-Errors.001
E:\Image\Test-UNC-Errors.002
…………………….
E:\Image\Test-UNC-Errors.051
Verification started: Fri Aug 06 00:44:33 2010
Verification finished: Fri Aug 06 01:04:12 2010
MD5 checksum: 1b26c0e62b79f528793199a3d2de4034 : verified
SHA1 checksum: 52bafa6d754870b33cb85089ae89538c9355844c :
verified
AFR-01 PASSED AIC-01 PASSED ALOG-01 PASSED
AFR-02 PASSED AIC-02 PASSED ALOG-02 PASSED
AFR-03 PASSED AIC-03 PASSED ALOG-03 PASSED
AFR-04 PASSED
AFR-05 PASSED AIC-06 PASSED
AFR-07 PASSED AIC-07 PASSED
AFR-08 PASSED
AIC-08 PASSED
AFR-09 PASSED
Analysis: Test achieved the expected Result. Source hashes match verification hashes.
182