Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

1.23 TC-11-DD_Smart
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
Test Case TC-11-DD_Smart (FTK Imager 2.9.0.1385)
Test &
Case
Summary:
Convert an existing image file to another image file format
Notes: Convert image from DD to Smart format
Assertion: AFR-03 The tool operates in an execution environment
Source
Device:
Drive
Setup:
Partition
Setup:
AFR-09
ALOG-
01
ALOG-
02
ALOG-
03
If there are unresolved errors reading from a digital source,
then the tool uses a benign fill in the destination object in
place of the inaccessible data.
If the tool logs any information regarding to the acquisition,
the information is accurately logged in the log file.
The tool display correct information about the acquisition to
the user.
The tool display correct information regarding to the
acquisition to the user and the information displayed is
consistent with the log file if the log file function is supported
Drive Model: ST380811 AS (80GB)
Serial Number: 6PS2CA4Z
Sector count: 156,296,385
Write blocker: N/A
Image: Original DD Image.
Source DD image hashes
MD5 checksum: f7c2c38630b0c995732a87cce003dcca
SHA1 checksum: 2043d334ef1ee9c1749427b249b3c983d4fcc8ed
Total sectors: 2104452 (1024MB)
/dev/sda: current max LBA: 156,296,385
/dev/sda: native max LBA: 156,296,385
/dev/sda: physical max LBA: 156,296,385
/dev/sda: HPA not set
/dev/sda: DCO not set
Device Start End #Sectors File System
/dev/sda1 63 41945714 41945652 HPFS/NTFS
/dev/sda2 4192965 156296384 152103420 Extended
/dev/sda5 4193028 6297479 2104452 FAT32
/dev/sda6 6297543 10490444 4192902 FAT16
/dev/sda7 10490508 12594959 1052226 Ext2
/dev/sda8 12595023 14699474 2104452 Ext3
/dev/sda9 14699538 18892439 4192902 HPFS/NTFS
/dev/sda10 18892503 19149479 256977 Swap
unallocated 19149480 156296384 137146905 Empty
193