Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

1.21 TC-11-E01_Smart
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
Test Case TC-11-E01_Smart (FTK Imager 2.9.0.1385)
Test &
Case
Summary:
Convert an existing image file to another image file format
Notes: Convert image from E01 to Smart format
Assertion: AFR-03 The tool operates in an execution environment
AFR-09 If there are unresolved errors reading from a digital source,
then the tool uses a benign fill in the destination object in
place of the inaccessible data.
ALOG-01 If the tool logs any information regarding to the acquisition,
the information is accurately logged in the log file.
ALOG-02 The tool display correct information about the acquisition to
the user.
ALOG-03 The tool display correct information regarding to the
acquisition to the user and the information displayed is
consistent with the log file if the log file function is
Source
Device:
Drive
Setup:
Partition
Setup:
supported
Drive Model: ST380811 AS (80GB)
Serial Number: 6PS2CA4Z
Sector count: 156,296,385
Write blocker: N/A
Image: Original E01 Image.
Source E01 image hashes
MD5 checksum: f7c2c38630b0c995732a87cce003dcca
SHA1 checksum: 2043d334ef1ee9c1749427b249b3c983d4fcc8ed
Total sectors: 2104452 (1024MB)
/dev/sda: current max LBA: 156,296,385
/dev/sda: native max LBA: 156,296,385
/dev/sda: physical max LBA: 156,296,385
/dev/sda: HPA not set
/dev/sda: DCO not set
Device Start End #Sectors File System
/dev/sda1 63 41945714 41945652 HPFS/NTFS
/dev/sda2 4192965 156296384 152103420 Extended
/dev/sda5 4193028 6297479 2104452 FAT32
/dev/sda6 6297543 10490444 4192902 FAT16
/dev/sda7 10490508 12594959 1052226 Ext2
/dev/sda8 12595023 14699474 2104452 Ext3
/dev/sda9 14699538 18892439 4192902 HPFS/NTFS
/dev/sda10 18892503 19149479 256977 Swap
unallocated 19149480 156296384 137146905 Empty
190