Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Source
Device:
Drive
Setup:
Partition
Table:
Log
highlights:
Helix3 Pro R3 (Release Date: 30 th , Dec 2009)
AFR-04 The tool creates an image file of the digital source
AFR-05 The tool acquires all the visible data sectors from the digital
source
AFR-07 All data sectors acquired from the digital source are acquired
accurately.
AIC-01 The data represented by an image file is the same as the data
acquired by the tool
AIC-05 If multi-file image creation and the image file size is selected,
the tool creates a multi-file image except that one file may be
smaller
ALOG-01 If the tool logs any information regarding to the acquisition,
the information is accurately logged in the log file.
ALOG-02 The tool display correct information about the acquisition to
the user.
ALOG-03 The tool display correct information regarding to the
acquisition to the user and the information displayed is
consistent with the log file if the log file function is supported
Drive Model: ST380811 AS (80GB)
Serial Number: 6PS2CA4Z
Sector count: 156,296,385
Write blocker: N/A
Source hashes
MD5: df377203665cf28c0db52707aa6f71d5
SHA1: 4194cfb81f69ad412cd0cc3806f81daa37102d73
/dev/sdb: current max LBA: 156,296,385
/dev/sdb: native max LBA: 156,296,385
/dev/sdb: physical max LBA: 156,296,385
/dev/sdb: HPA not set
/dev/sdb: DCO not set
Device Start End #sectors System
/dev/sdb1 63 4192964 4192902 NTFS
/dev/sdb2 4193028 6297479 2104452 FAT32
/dev/sdb3 6297543 10490444 4192902 FAT16
/dev/sdb4 10490508 12594959 2104452 Ext2
/dev/sdb5 12595023 14699474 2104452 Ext3
/deb/sdb6 18892503 19149479 256977 Swap
unallocated 19149480 156296384 137146905 Empty
Created By Helix3 Pro 2009R3
logicalname /dev/sdb4
dev 8d:23d
capacity 1077479424
WholeDisk False
VendorName Unknown
ACQUISITION INFORMATION
Acquire Format: RAW
Acquisition Start: 2010-07-26 18:50:08
Acquisition Stop 2010-07-26 18:51:05
Output File(s):
216