Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
1.17 TC-07- Insufficient space & TC-08
Test Case TC-07-Insufficient space & TC-08 (FTK Imager 2.9.0.1385)
Test &
Case
Summary:
Attempt to create an image file where destination device has insufficient
space , and see whether the tool notifies the user and offer another
destination device to continue
Assertion: AFR-01 The tool accesses the digital source with a supported access interface
AFR-02 The tool acquires a digital source
AFR-03 The tool operates in an execution environment
AFR-04 The tool creates an image file of the digital source
AFR-05 The tool acquires all the visible data sectors from the digital source
AFR-07 All data sectors acquired from the digital source are acquired accurately.
AIC-04 The tool reports to the user if insufficient space in the destination device
during the image creation process.
AIC-05 If multi-file image creation and the image file size is selected, the tool
creates a multi-file image except that one file may be smaller
AIC-10 The tool reports to the user if insufficient space in the destination device to
contain the multi-image file creation and if destination device switching
function is supported, the image is continue on the selected destination
device.
ALOG-01 If the tool logs any information regarding to the acquisition, the
information is accurately logged in the log file.
ALOG-02 The tool display correct information about the acquisition to the user.
ALOG-03 The tool display correct information regarding to the acquisition to the
user and the information displayed is consistent with the log file if the log
file function is supported
Source
Device:
Drive
Setup:
Partition
Table:
Log
highlights:
Drive Model: ST380811 AS (80GB)
Serial Number: 6PS2CA4Z
Sector count: 156,296,385
Write blocker: Tableau Forensic SATA/IDE Bridge IEEE 1394 SBP2
Device
/dev/sdc: current max LBA: 156,296,385
/dev/sdc: native max LBA: 156,296,385
/dev/sdc: physical max LBA: 156,296,385
/dev/sdc: HPA not set
/dev/sdc: DCO not set
Device Start End #sectors System
unallocated 0 156296384 156296385 Empty
183