Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Results by
assertion:
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
Source data size: 76319 MB
Sector count: 156301488
[Computed Hashes]
MD5 checksum: 3170cec7e6720af973cc37a946c32ae3
SHA1 checksum: 6366ad8cd563c05f086dfe7b7884b08fd9795069
Image Information:
Acquisition started: Wed Sep 08 13:08:19 2010
Acquisition finished: Wed Sep 08 14:24:42 2010
Segment list:
E:\Image\FTK-OverlapPartition.001
E:\Image\FTK-OverlapPartition.002
………………..
E:\Image\FTK-OverlapPartition.051
Image Verification Results:
Verification started: Wed Sep 08 14:24:42 2010
Verification finished: Wed Sep 08 14:42:36 2010
MD5 checksum: 3170cec7e6720af973cc37a946c32ae3 : verified
SHA1 checksum: 6366ad8cd563c05f086dfe7b7884b08fd9795069 :
verified
AFR-01 PASSED AIC-01 PASSED
AFR-02 PASSED AIC-02 PASSED
AFR-03 PASSED AIC-11 FAILED
AFR-04 PASSED ALOG-01 PASSED
AFR-05 PASSED ALOG-02 PASSED
AFR-07 PASSED ALOG-03 PASSED
Analysis: Test FAILED to achieve the expected Result. FTK Imager is able to recover
the overlapped partition table. However, irregularity of the partition table is
not reported to the user.
1.29 TC-14 Partition out of boundary
Test Case TC-14 Partition out of boundary (FTK Imager 2.9.0.1385)
Test &
Case
Summary:
Acquire a hard disk with a partition‟s end address ended outside the physical
boundary
Notes: Partitions ended out of the physical boundary of the disk. The last partition end
sector changed from 72,331,264 to 72,380,000.
Assertions: AFR-01 The tool accesses the digital source with a supported access interface
AFR-02 The tool acquires a digital source
AFR-03 The tool operates in an execution environment
AFR-04 The tool creates an image file of the digital source
AFR-05 The tool acquires all the visible data sectors from the digital source
AFR-07 All data sectors acquired from the digital source are acquired accurately.
AIC-01
The data represented by an image file is the same as the data acquired by the
tool
AIC-02 The tool creates an image file according to the file format the user specified.
AIC-11 The tool reports to the user if any irregularities found in the digital source.
ALOG- If the tool logs any information regarding to the acquisition, the information is
01 accurately logged in the log file.
ALOG- The tool display correct information about the acquisition to the user. The
202