Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

2.7. TC-02-FAT32
Helix3 Pro R3 (Release Date: 30 th , Dec 2009)
Test Case TC-02-FAT32 (Helix3 Pro 2009 R3)
Test & TC-02 Acquire a digital source that supported by the tools to an image file
Case
Summary: Notes: Acquire FAT32 only partition in a multi-partitioned HD using Helix
Live CD. WriteBlocker not used
Sector starts from:4193028 to 6297479
total sector: 2104452
Assertion: AFR-01 The tool accesses the digital source with a supported access
interface
AFR-02 The tool acquires a digital source
AFR-03 The tool operates in an execution environment
AFR-04 The tool creates an image file of the digital source
AFR-05 The tool acquires all the visible data sectors from the digital
source
AFR-07 All data sectors acquired from the digital source are acquired
accurately.
AIC-01 The data represented by an image file is the same as the data
acquired by the tool
AIC-05 If multi-file image creation and the image file size is selected,
the tool creates a multi-file image except that one file may be
smaller
ALOG-01 If the tool logs any information regarding to the acquisition,
the information is accurately logged in the log file.
ALOG-02 The tool display correct information about the acquisition to
the user.
ALOG-03 The tool display correct information regarding to the
acquisition to the user and the information displayed is
consistent with the log file if the log file function is supported
Source Drive Model: ST380811 AS (80GB)
Device: Serial Number: 6PS2CA4Z
Sector count: 156,296,385
Write blocker: N/A
Drive Source hashes
Setup: MD5: 2c22fded78dc8ccc2c935944883a2e1b
SHA1: 10eaa99a609cd8d215c9dc5a68f46e2e0d5c68c5
/dev/sdb: current max LBA: 156,296,385
/dev/sdb: native max LBA: 156,296,385
/dev/sdb: physical max LBA: 156,296,385
/dev/sdb: HPA not set
/dev/sdb: DCO not set
Partition
Table:
Device Start End #sectors System
/dev/sdb1 63 4192964 4192902 NTFS
/dev/sdb2 4193028 6297479 2104452 FAT32
/dev/sdb3 6297543 10490444 4192902 FAT16
/dev/sdb4 10490508 12594959 2104452 Ext2
/dev/sdb5 12595023 14699474 2104452 Ext3
/deb/sdb6 18892503 19149479 256977 Swap
unallocated 19149480 156296384 137146905 Empty
221