Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Source
Device:
Drive
Setup:
Partition
Table:
Log
highlights:
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
02 information about the acquisition at least including following: device, start
sector, end sector, type and number of errors encountered, and start time and
ALOG-
03
end time of acquisition.
The tool display correct information regarding to the acquisition to the user
and the information displayed is consistent with the log file if the log file
function is supported
Drive Model: ST380817AS (80GB)
Serial Number: 5MR18V18
Sector count: 156,301,488
Write blocker: Tableau Forensic SATA/IDE Bridge IEEE 1394 SBP2
Device
/dev/sdb: current max LBA: 156,301,488
/dev/sdb: native max LBA: 156,301,488
/dev/sdb: physical max LBA: 156,301,488
/dev/sdb: HPA and DCO are not set
Device Start End #sectors File System
/dev/sdb1 2048 40962047 40960000 NTFS
/dev/sdb2 40962048 83970047 43008000 Ext4
/dev/sdb3 83972096 156350047 72377951 Extended
(Modified)
Created By AccessData® FTK® Imager 2.9.0.1385 100406
Case Number: FTK-OutOfBoundaryPartition
Examiner: James Liang
[Drive Geometry]
Cylinders: 9,729
Tracks per Cylinder: 255
Sectors per Track: 63
Bytes per Sector: 512
Sector Count: 156,301,488
[Physical Drive Information]
Drive Model: Tableau Forensic SATA/IDE Bridge IEEE 1394 SBP2 Device
Drive Serial Number: 02cc0e0010903500
Drive Interface Type: 1394
Source data size: 76319 MB
Sector count: 156301488
[Computed Hashes]
MD5 checksum: b42f526d394078656308a9b96aa77188
SHA1 checksum: e2977a0cd2d2608519b1750e980252d01cdb4718
Image Information:
Acquisition started: Fri Sep 10 02:02:27 2010
Acquisition finished: Fri Sep 10 02:56:06 2010
Segment list:
E:\Image\FTK-OutOfBoundaryPartition.001
E:\Image\FTK-OutOfBoundaryPartition.002
…………………….
E:\Image\FTK-OutOfBoundaryPartition.051
Image Verification Results:
Verification started: Fri Sep 10 02:56:11 2010
Verification finished: Fri Sep 10 03:42:24 2010
MD5 checksum: b42f526d394078656308a9b96aa77188 : verified
SHA1 checksum: e2977a0cd2d2608519b1750e980252d01cdb4718 :
203