Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Source
Device:
Drive
Setup:
Partition
Table:
Log
highlights:
AHS-03
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
The tool reports to the user that hidden sectors will not be acquired if the tool
is unable to acquire hidden sectors due to incompatible execution
environment
Drive Model: ST380817AS (80GB)
Serial Number: 5MR18V18
Sector count: 156,301,488
Write blocker: N/A
/dev/sdb: current max LBA: 149,565,150
/dev/sdb: native max LBA: 149,565,150
/dev/sdb: physical max LBA: 156,301,488
/dev/sdb: HPA set from sector 149,565,150 to 156,301,487 (Total
6,736,337 sectors)
Device Start End #sectors File System
/dev/sdb1 63 2104514 2104452 NTFS
/dev/sdb2 2104515 149565149 145460535 Ext3
/dev/sdb3 149565150 156296384 6731234 FAT32 (Entire
HPA)
Results by
assertion: AFR-01 PASSED AIC-01 FAILED AHS-02 FAILED
AFR-02 PASSED AIC-02 FAILED AHS-03 FAILED
AFR-03 PASSED AIC-05 FAILED ALOG-01 FAILED
AFR-04 FAILED AIC-06 FAILED ALOG-02 FAILED
AFR-05 FAILED AIC-07 FAILED ALOG-03 FAILED
AFR-06 FAILED AIC-08 FAILED
AFR-07 FAILED AHS-01 FAILED
Analysis: Test FAILED to achieve the expected Result. FTK Imager is able to detect
the partition information correctly. However, FTK Imager freezes at the
preparing to create image.
200