Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
2.3. TC-02-NTFS<br />
Helix3 Pro R3 (Release Date: 30 th , Dec 2009)<br />
Test Case TC-02-NTFS (Helix3 Pro 2009 R3)<br />
Test & TC-02 Acquire a digital source that supported by the tools to an image file<br />
Case<br />
Summary: Notes: Acquire NTFS partition only. Sector start from 63 to 4192964.<br />
Total sector:4192902<br />
Assertion: AFR-01 The tool accesses the digital source with a supported access<br />
interface<br />
AFR-02 The tool acquires a digital source<br />
AFR-03 The tool operates in an execution environment<br />
AFR-04 The tool creates an image file <strong>of</strong> the digital source<br />
AFR-05 The tool acquires all the visible data sectors from the digital<br />
source<br />
AFR-07 All data sectors acquired from the digital source are acquired<br />
accurately.<br />
AIC-01 The data represented by an image file is the same as the data<br />
acquired by the tool<br />
AIC-05 If multi-file image creation and the image file size is selected,<br />
the tool creates a multi-file image except that one file may be<br />
smaller<br />
ALOG-01 If the tool logs any in<strong>for</strong>mation regarding to the acquisition,<br />
the in<strong>for</strong>mation is accurately logged in the log file.<br />
ALOG-02 The tool display correct in<strong>for</strong>mation about the acquisition to<br />
the user.<br />
ALOG-03 The tool display correct in<strong>for</strong>mation regarding to the<br />
acquisition to the user and the in<strong>for</strong>mation displayed is<br />
consistent with the log file if the log file function is supported<br />
Source Drive Model: ST380811 AS (80GB)<br />
Device: Serial Number: 6PS2CA4Z<br />
Sector count: 156,296,385<br />
Write blocker: Tableau <strong>Forensic</strong> SATA/IDE Bridge IEEE 1394 SBP2<br />
Device<br />
Drive Source hashes<br />
Setup: MD5: 93d88289dc48d350cf1b979c92897715<br />
SHA1: 8a6172e0ff6b103ce0436d36ffeb274f7f075edb<br />
/dev/sdb: current max LBA: 156,296,385<br />
/dev/sdb: native max LBA: 156,296,385<br />
/dev/sdb: physical max LBA: 156,296,385<br />
/dev/sdb: HPA not set<br />
/dev/sdb: DCO not set<br />
Partition<br />
Table:<br />
Device Start End #sectors System<br />
/dev/sdb1 63 4192964 4192902 NTFS<br />
/dev/sdb2 4193028 6297479 2104452 FAT32<br />
/dev/sdb3 6297543 10490444 4192902 FAT16<br />
/dev/sdb4 10490508 12594959 2104452 Ext2<br />
/dev/sdb5 12595023 14699474 2104452 Ext3<br />
/deb/sdb6 18892503 19149479 256977 Swap<br />
214
Change language