Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Results by
assertion:
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
MD5 checksum: 771c7d34ed7a9b12e1419d8783b0f3e7 : FAILED
SHA1 checksum: b9929b149d49658e418138eefa1aa9e49fc97710 :
FAILED
AFR-03 PASSED ALOG-01 PASSED
AIC-06 PASSED ALOG-02 PASSED
AIC-07 PASSED ALOG-03 PASSED
AIC-08 FAILED
Analysis: Test FAILED to achieve the expected Result. FTK Imager detected the
image has corrupted. However, the location of the corrupted data is not
reported to the user.
1.20 TC-11-E01_DD
Test Case TC-11-E01_DD (FTK Imager 2.9.0.1385)
Test &
Case
Summary:
Convert an existing image file to another image file format
Notes: Convert image from E01 to DD format
Assertion: AFR-03 The tool operates in an execution environment
AFR-09 If there are unresolved errors reading from a digital source,
then the tool uses a benign fill in the destination object in
place of the inaccessible data.
ALOG-01 If the tool logs any information regarding to the acquisition,
the information is accurately logged in the log file.
ALOG-02 The tool display correct information about the acquisition to
the user.
ALOG-03 The tool display correct information regarding to the
acquisition to the user and the information displayed is
consistent with the log file if the log file function is
Source
Device:
Drive
Setup:
supported
Drive Model: ST380811 AS (80GB)
Serial Number: 6PS2CA4Z
Sector count: 156,296,385
Write blocker: N/A
Image: Original E01 Image.
Source E01 image hashes
MD5 checksum: f7c2c38630b0c995732a87cce003dcca
SHA1 checksum: 2043d334ef1ee9c1749427b249b3c983d4fcc8ed
Total sectors: 2104452 (1024MB)
/dev/sda: current max LBA: 156,296,385
/dev/sda: native max LBA: 156,296,385
/dev/sda: physical max LBA: 156,296,385
/dev/sda: HPA not set
/dev/sda: DCO not set
188