Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Source
Device:
Drive
Setup:
Log
highlights:
Results by
assertion:
Helix3 Pro R3 (Release Date: 30 th , Dec 2009)
the user.
ALOG-03 The tool display correct information regarding to the
acquisition to the user and the information displayed is
consistent with the log file if the log file function is
supported
Drive Model: USB 2.0 Drive (4GB)
Serial Number: N/A
Sector count: 7,987,200
Write blocker: Tableau T8 Forensic USB Bridge
Source hashes
MD5: fcf954774adec1eefb4b873b3c8f3612
SHA1: 033772e928aea0c52827574cfb2c7f020062aa84
/dev/sda: current max LBA: 7,987,200
/dev/sda: native max LBA: 7,987,200
/dev/sda: physical max LBA: 7,987,200
/dev/sda: HPA not set
/dev/sda: DCO not set
Created By Helix3 Pro 2009R3
OS Name Windows XP
OS Patch Service Pack 3
Computer Name JAMES-212DFE2EF
Administrator True
size 4087964160
name PhysicalDrive1
serialnumber 1100
system Flash Disk
firmware USB2.0
WholeDisk True
Acquire Format: RAW
Acquisition Start: 2010-09-21 08:13:58
Acquisition Stop 2010-09-21 08:27:52
Output File(s):
G:\Image\Helix-TC01-USB-WHOLE.001
G:\Image\Helix-TC01-USB-WHOLE.002
Verification: Passed
Hash(es):
MD5: fcf954774adec1eefb4b873b3c8f3612
SHA1: 033772e928aea0c52827574cfb2c7f020062aa84
AFR-01 PASSED AIC-01 PASSED
AFR-02 PASSED AIC-05 PASSED
AFR-03 PASSED ALOG-01 PASSED
AFR-04 PASSED ALOG-02 FAILED
AFR-05 PASSED ALOG-03 PASSED
AFR-07 PASSED
Analysis: Test FAILED to achieve the expected Result. The acquired start and end
sectors were not displayed and reported to the user.
213