Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Results by
assertion:
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
System date: 8/10/2010 3:37:58 PM
Source data size: 1027 MB
Sector count: 2104452
MD5 checksum: f7c2c38630b0c995732a87cce003dcca
SHA1 checksum: 2043d334ef1ee9c1749427b249b3c983d4fcc8ed
Acquisition started: Wed Aug 11 03:51:17 2010
Acquisition finished: Wed Aug 11 03:51:44 2010
Segment list:
G:\new\Test005-AltFor-FTK\Test005-FTK-SmartToE01.E01
Verification started: Wed Aug 11 03:51:44 2010
Verification finished: Wed Aug 11 03:52:03 2010
MD5 checksum: f7c2c38630b0c995732a87cce003dcca : verified
SHA1 checksum: 2043d334ef1ee9c1749427b249b3c983d4fcc8ed :
verified
AFR-03 PASSED ALOG-01 PASSED
AFR-09 PASSED ALOG-02 PASSED
ALOG-03 PASSED
Analysis: Test achieved the expected Result. Source hashes match verification
hashes and the hash of the original Smart image.
1.26 TC-12-01 Partially Hidden by HPA
Test Case TC-12-01 Partially Hidden by HPA (FTK Imager 2.9.0.1385)
Test &
Case
Summary:
Acquire a partition that is partially or completely hidden by HPA or DCO
Notes: FAT32 partition has been partially hidden by HPA from 150301488 to 156301487.
Assertion: AFR-01 The tool accesses the digital source with a supported access interface
AFR-02 The tool acquires a digital source
AFR-03 The tool operates in an execution environment
AFR-04 The tool creates an image file of the digital source
AFR-05 The tool acquires all the visible data sectors from the digital source
AFR-06 The tool acquires all the hidden data sectors from the digital source
AFR-07 All data sectors acquired from the digital source are acquired accurately.
AIC-01
The data represented by an image file is the same as the data acquired by the
tool
AIC-02 The tool creates an image file according to the file format the user specified.
AIC-05
If multi-file image creation and the image file size is selected, the tool creates
a multi-file image except that one file may be smaller
AIC-06
If the image file integrity check is selected, the tool shall report to the user the
image file has not been changed if the image file has not been changed.
AIC-07
If the image file integrity check is selected, the tool shall report to the user the
AIC-08
ALOG-
01
ALOG-
02
image file has been changed if the image file has been changed.
If the image file integrity check is selected, the tool shall report to the user the
image file has been changed and the involved location if the image file has
been changed.
If the tool logs any information regarding to the acquisition, the information is
accurately logged in the log file.
The tool display correct information about the acquisition to the user. The
information about the acquisition at least including following: device, start
197