Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Results by<br />
assertion:<br />
Helix3 Pro R3 (Release Date: 30 th , Dec 2009)<br />
Acquisition Stop 2010-07-26 18:57:44<br />
Output File(s):<br />
/mnt/new/Image/Test002-Helix-Swap.001<br />
Verification: Passed<br />
Hash(es):<br />
MD5: d7465eb87f553639e35c177775561e77<br />
SHA1: ddd3a59446ce3fe46582f505a37a4e77f52caca2<br />
SHA256:<br />
bfbdf4db1d346ef8ef1ffb3fe17e40ce9965adaf3a0f057b08ac13b11490b1d7<br />
SHA512:<br />
d14ba77e3d31c558daf544b18d45ecebbaff6081a4ef59e9945c452b4b84181<br />
941641b62784b356017a6c957909548cb11ca7cf1838c2ffceb2fee4d0f35db<br />
e1<br />
AFR-01 PASSED AIC-01 PASSED<br />
AFR-02 PASSED AIC-05 PASSED<br />
AFR-03 PASSED ALOG-01 PASSED<br />
AFR-04 PASSED ALOG-02 FAILED<br />
AFR-05 PASSED ALOG-03 PASSED<br />
AFR-07 PASSED<br />
Analysis: Test FAILED to achieve the expected Result. The acquired start and end<br />
sectors were not displayed and reported to the user.<br />
2.9. TC-02-HFS & HFS+<br />
Test Case TC-02-HFS & HFS+ (Helix3 Pro 2009 R3)<br />
Test &<br />
Case<br />
Summary:<br />
Assertion:<br />
TC-02 Acquire a digital source that supported by the tools to an image file<br />
Notes: Acquire HFS and HFS+ partition only in a multi-partitioned HD<br />
using Helix Live CD.<br />
AFR-01<br />
The tool accesses the digital source with a supported access<br />
interface<br />
AFR-02 The tool acquires a digital source<br />
AFR-03 The tool operates in an execution environment<br />
AFR-04 The tool creates an image file <strong>of</strong> the digital source<br />
AFR-05<br />
The tool acquires all the visible data sectors from the digital<br />
source<br />
AFR-07<br />
All data sectors acquired from the digital source are acquired<br />
accurately.<br />
AIC-01<br />
The data represented by an image file is the same as the data<br />
AIC-05<br />
ALOG-01<br />
ALOG-02<br />
ALOG-03<br />
acquired by the tool<br />
If multi-file image creation and the image file size is selected,<br />
the tool creates a multi-file image except that one file may be<br />
smaller<br />
If the tool logs any in<strong>for</strong>mation regarding to the acquisition,<br />
the in<strong>for</strong>mation is accurately logged in the log file.<br />
The tool display correct in<strong>for</strong>mation about the acquisition to<br />
the user.<br />
The tool display correct in<strong>for</strong>mation regarding to the<br />
acquisition to the user and the in<strong>for</strong>mation displayed is<br />
224
Change language