Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Source
Device:
Drive
Setup:
Partition
Table:
Log
highlights:
Results by
assertion:
Helix3 Pro R3 (Release Date: 30 th , Dec 2009)
consistent with the log file if the log file function is supported
Drive Model: ST380811 AS (80GB)
Serial Number: 6PS2CA4Z
Sector count: 156,296,385
Write blocker: N/A
Source hashes
MD5: d8235a6c57ddf91c902d42f0e39cb7d5
SHA1: b91e9115388276b961e6a94a6322337048734d6c
/dev/sdb: current max LBA: 156,296,385
/dev/sdb: native max LBA: 156,296,385
/dev/sdb: physical max LBA: 156,296,385
/dev/sdb: HPA not set
/dev/sdb: DCO not set
Device Start End #sectors File System Size
/dev/sdb1 4096 4198399 4194304 HFS 2Gb
/dev/sdb2 4198400 14999551 10801152 HFS+ 5Gb
Unallocated
AFR-01 PASSED AIC-01 N/A
AFR-02 FAILED AIC-05 N/A
AFR-03 PASSED ALOG-01 N/A
AFR-04 FAILED ALOG-02 N/A
AFR-05 N/A ALOG-03 N/A
AFR-07 N/A
Analysis: Test FAILED to achieve the expected Result. Helix 3 Pro cannot identify
the HFS or HFS+ partitions
2.10. TC-03-HPA
Test Case TC-03-HPA (Helix3 Pro 2009 R3)
Test &
Case
Summary:
TC-03 Acquire a hard drive with hidden sectors to an image file
Notes: HPA actived
Assertion: AFR-01 The tool accesses the digital source with a supported access interface
AFR-02 The tool acquires a digital source
AFR-03 The tool operates in an execution environment
AFR-04 The tool creates an image file of the digital source
AFR-05 The tool acquires all the visible data sectors from the digital source
AFR-06 The tool acquires all the hidden data sectors from the digital source
225