Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
1.28 TC-13 Overlapping Partitions<br />
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)<br />
Test Case TC-13 Overlapping Partitions (FTK Imager 2.9.0.1385)<br />
Test &<br />
Case<br />
Summary:<br />
Acquire a partition that is overlapping with another partition<br />
Notes: Partitions are overlapped. The last NTFS partition started be<strong>for</strong>e the end <strong>of</strong> the last<br />
partition. Starting sector changed from 79,168,320 to 79,100,000.<br />
Assertions: AFR-01 The tool accesses the digital source with a supported access interface<br />
AFR-02 The tool acquires a digital source<br />
AFR-03 The tool operates in an execution environment<br />
AFR-04 The tool creates an image file <strong>of</strong> the digital source<br />
AFR-05 The tool acquires all the visible data sectors from the digital source<br />
Source<br />
Device:<br />
Drive<br />
Setup:<br />
Partition<br />
Table:<br />
Log<br />
highlights:<br />
AFR-07 All data sectors acquired from the digital source are acquired accurately.<br />
AIC-01<br />
The data represented by an image file is the same as the data acquired by the<br />
tool<br />
AIC-02 The tool creates an image file according to the file <strong>for</strong>mat the user specified.<br />
AIC-11 The tool reports to the user if any irregularities found in the digital source.<br />
ALOG- If the tool logs any in<strong>for</strong>mation regarding to the acquisition, the in<strong>for</strong>mation is<br />
01 accurately logged in the log file.<br />
The tool display correct in<strong>for</strong>mation about the acquisition to the user. The<br />
ALOG- in<strong>for</strong>mation about the acquisition at least including following: device, start<br />
02 sector, end sector, type and number <strong>of</strong> errors encountered, and start time and<br />
end time <strong>of</strong> acquisition.<br />
ALOG-<br />
03<br />
The tool display correct in<strong>for</strong>mation regarding to the acquisition to the user<br />
and the in<strong>for</strong>mation displayed is consistent with the log file if the log file<br />
function is supported<br />
Drive Model: ST380817AS (80GB)<br />
Serial Number: 5MR18V18<br />
Sector count: 156,301,488<br />
Write blocker: Tableau <strong>Forensic</strong> SATA/IDE Bridge IEEE 1394 SBP2<br />
Device<br />
Source Hashes:<br />
md5: 3170cec7e6720af973cc37a946c32ae3<br />
sha1: 6366ad8cd563c05f086dfe7b7884b08fd9795069<br />
/dev/sdb: current max LBA: 156,301,488<br />
/dev/sdb: native max LBA: 156,301,488<br />
/dev/sdb: physical max LBA: 156,301,488<br />
/dev/sdb: HPA and DCO are not set<br />
Device Start End #sectors File System<br />
/dev/sdb1 63 20980764 20980827 NTFS<br />
/dev/sdb2 20980890 79168320 58187430 Ext3<br />
/dev/sdb3 79100000 156296385 77128065 NTFS (Modified)<br />
Created By Access<strong>Data</strong>® FTK® Imager 2.9.0.1385 100406<br />
Case Number: TC-OverlappingPartition-FTK<br />
Examiner: James Liang<br />
[Drive Geometry]<br />
Cylinders: 9,729<br />
Tracks per Cylinder: 255<br />
Sectors per Track: 63<br />
Bytes per Sector: 512<br />
Sector Count: 156,301,488<br />
[Physical Drive In<strong>for</strong>mation]<br />
Drive Model: ST380817 AS USB Device<br />
Drive Serial Number: 5MR18V18<br />
Drive Interface Type: USB<br />
201