Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Results by
assertion:
verified
FTK Imager 2.9.0.1385 (Release Date: 8 th , Apr 2010)
AFR-01 PASSED AIC-01 PASSED
AFR-02 PASSED AIC-02 PASSED
AFR-03 PASSED AIC-11 FAILED
AFR-04 PASSED ALOG-01 PASSED
AFR-05 PASSED ALOG-02 PASSED
AFR-07 PASSED ALOG-03 PASSED
Analysis: Test FAILED to achieve the expected Result. All the data are acquired
correctly but FTK Imager failed to report to the user that irregularities in the
digital source.
1.30 TC-15 Unreadable MBR
Test Case TC-15 Unreadable MBR (FTK Imager 2.9.0.1385)
Test &
Case
Summary:
Acquire a hard disk with an unreadable MBR
Notes: Partitions ended out of the physical boundary of the disk. Data of MBR is replaced
by value 0.
Assertions: AFR-01 The tool accesses the digital source with a supported access interface
AFR-02 The tool acquires a digital source
AFR-03 The tool operates in an execution environment
AFR-04 The tool creates an image file of the digital source
AFR-05 The tool acquires all the visible data sectors from the digital source
AFR-07 All data sectors acquired from the digital source are acquired accurately.
AFR-08
The tool reports to the user of the error type and the location of the error if
error occurred during the reading from a digital source.
AFR-09
If there are unresolved errors reading from a digital source, then the tool uses
Source
Device:
a benign fill in the destination object in place of the inaccessible data.
AIC-01
The data represented by an image file is the same as the data acquired by the
tool
AIC-02 The tool creates an image file according to the file format the user specified.
AIC-03
The tool reports to the user if an error occurs during the image creation
process.
AIC-05
If multi-file image creation and the image file size is selected, the tool creates
a multi-file image except that one file may be smaller
AIC-06
If the image file integrity check is selected, the tool shall report to the user the
image file has not been changed if the image file has not been changed.
AIC-07
If the image file integrity check is selected, the tool shall report to the user the
image file has been changed if the image file has been changed.
If the image file integrity check is selected, the tool shall report to the user the
AIC-08 image file has been changed and the involved location if the image file has
been changed.
AIC-11 The tool reports to the user if any irregularities found in the digital source.
ALOG- If the tool logs any information regarding to the acquisition, the information is
01 accurately logged in the log file.
The tool display correct information about the acquisition to the user. The
ALOG- information about the acquisition at least including following: device, start
02 sector, end sector, type and number of errors encountered, and start time and
end time of acquisition.
The tool display correct information regarding to the acquisition to the user
ALOGand
the information displayed is consistent with the log file if the log file
03
function is supported
Drive Model: ST380817AS (80GB)
Serial Number: 5MR18V18
204