Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
1.25 TC-11-Smart_E01<br />
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)<br />
Test Case TC-11-Smart_E01 (FTK Imager 2.9.0.1385)<br />
Test &<br />
Case<br />
Summary:<br />
Convert an existing image file to another image file <strong>for</strong>mat<br />
Notes: Convert image from Smart to EnCase E01 <strong>for</strong>mat<br />
Assertion: AFR-03 The tool operates in an execution environment<br />
Source<br />
Device:<br />
Drive<br />
Setup:<br />
Partition<br />
Setup:<br />
Log<br />
highlights:<br />
AFR-09<br />
ALOG-01<br />
ALOG-02<br />
ALOG-03<br />
If there are unresolved errors reading from a digital source,<br />
then the tool uses a benign fill in the destination object in<br />
place <strong>of</strong> the inaccessible data.<br />
If the tool logs any in<strong>for</strong>mation regarding to the acquisition,<br />
the in<strong>for</strong>mation is accurately logged in the log file.<br />
The tool display correct in<strong>for</strong>mation about the acquisition to<br />
the user.<br />
The tool display correct in<strong>for</strong>mation regarding to the<br />
acquisition to the user and the in<strong>for</strong>mation displayed is<br />
consistent with the log file if the log file function is supported<br />
Drive Model: ST380811 AS (80GB)<br />
Serial Number: 6PS2CA4Z<br />
Sector count: 156,296,385<br />
Write blocker: N/A<br />
Image: Original Smart Image.<br />
Source Smart image hashes<br />
MD5 checksum: f7c2c38630b0c995732a87cce003dcca<br />
SHA1 checksum: 2043d334ef1ee9c1749427b249b3c983d4fcc8ed<br />
Total sectors: 2104452 (1024MB)<br />
/dev/sda: current max LBA: 156,296,385<br />
/dev/sda: native max LBA: 156,296,385<br />
/dev/sda: physical max LBA: 156,296,385<br />
/dev/sda: HPA not set<br />
/dev/sda: DCO not set<br />
Device Start End #Sectors File System<br />
/dev/sda1 63 41945714 41945652 HPFS/NTFS<br />
/dev/sda2 4192965 156296384 152103420 Extended<br />
/dev/sda5 4193028 6297479 2104452 FAT32<br />
/dev/sda6 6297543 10490444 4192902 FAT16<br />
/dev/sda7 10490508 12594959 1052226 Ext2<br />
/dev/sda8 12595023 14699474 2104452 Ext3<br />
/dev/sda9 14699538 18892439 4192902 HPFS/NTFS<br />
/dev/sda10 18892503 19149479 256977 Swap<br />
unallocated 19149480 156296384 137146905 Empty<br />
Created By Access<strong>Data</strong>® FTK® Imager 2.9.0.1385 100406<br />
MD5 verification hash: f7c2c38630b0c995732a87cce003dcca<br />
SHA1 verification hash: 2043d334ef1ee9c1749427b249b3c983d4fcc8ed<br />
Bytes per Sector: 512<br />
Sector Count: 2,104,452<br />
Image Type: SMART ew-compressed<br />
Acquired on OS: Windows 200x<br />
Acquired using: ADI2.9.0.13<br />
Acquire date: 8/10/2010 3:37:58 PM<br />
196