Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Results by
assertion:
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
TC-07
AFR-01 PASSED
AFR-02 PASSED
AFR-03 PASSED
AFR-04 PASSED
AIC-04 PASSED
TC-08
AFR-01 PASSED
AFR-02 PASSED
AFR-03 PASSED
AFR-04 PASSED
AFR-05 PASSED
AFR-07 PASSED
ALOG-01 PASSED
ALOG-02 PASSED
ALOG-03 PASSED
AIC-04 PASSED ALOG-01 PASSED
AIC-05 PASSED ALOG-02 PASSED
AIC-10 PASSED ALOG-03 PASSED
Analysis: Test result PASSED. Notification has provided to the user that the
destination device does not have enough free space to store the full image.
Space checking is not done prior to the image acquisition.
1.18 TC-09-VerifyImage
Test Case TC-09-VerifyImage (FTK Imager 2.9.0.1385)
Test &
Case
Summary:
Verify a correct image
Notes: The image of FAT16 partition.
Assertion: AFR-03 The tool operates in an execution environment
AIC-06 If the image file integrity check is selected, the tool shall report
to the user the image file has not been changed if the image file
has not been changed.
ALOG-01 If the tool logs any information regarding to the acquisition,
the information is accurately logged in the log file.
ALOG-02 The tool display correct information about the acquisition to
the user.
ALOG-03 The tool display correct information regarding to the
acquisition to the user and the information displayed is
Source
Device:
Drive
Setup:
consistent with the log file if the log file function is supported
Drive Model: ST380811 AS (80GB)
Serial Number: 6PS2CA4Z
Sector count: 156,301,488
Write blocker: N/A
Source image hashes
MD5 checksum: cbf8f802e41c7ddbfb0afeaa5c7d0de0
SHA1 checksum: fa59e48af260bcd9e874286b0e1026f03b461220
Total sectors: 4192902 (2047MB)
/dev/sda: current max LBA: 156,301,488
/dev/sda: native max LBA: 156,301,488
/dev/sda: physical max LBA: 156,301,488
/dev/sda: HPA not set
184