Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

2.11. TC-03-DCO
Helix3 Pro R3 (Release Date: 30 th , Dec 2009)
Test Case TC-03-DCO (Helix3 Pro 2009 R3)
Test &
Case
Summary:
TC-03 Acquire a hard drive with hidden sectors to an image file
Notes: DCO active
Assertion: AFR-01 The tool accesses the digital source with a supported access interface
AFR-02 The tool acquires a digital source
AFR-03 The tool operates in an execution environment
AFR-04 The tool creates an image file of the digital source
AFR-05 The tool acquires all the visible data sectors from the digital source
AFR-06 The tool acquires all the hidden data sectors from the digital source
AFR-07 All data sectors acquired from the digital source are acquired accurately.
AIC-01 The data represented by an image file is the same as the data acquired by the
tool
AIC-02 The tool creates an image file according to the file format the user specified.
AIC-05 If multi-file image creation and the image file size is selected, the tool creates
a multi-file image except that one file may be smaller
AIC-06 If the image file integrity check is selected, the tool shall report to the user the
image file has not been changed if the image file has not been changed.
AIC-07 If the image file integrity check is selected, the tool shall report to the user the
image file has been changed if the image file has been changed.
AIC-08 If the image file integrity check is selected, the tool shall report to the user the
image file has been changed and the involved location if the image file has
been changed.
ALOG- If the tool logs any information regarding to the acquisition, the information is
Source
Device:
Drive
Setup:
Partition
Table:
01
ALOG-
02
ALOG-
03
accurately logged in the log file.
The tool display correct information about the acquisition to the user. The
information about the acquisition at least including following: device, start
sector, end sector, type and number of errors encountered, and start time and
end time of acquisition.
The tool display correct information regarding to the acquisition to the user
and the information displayed is consistent with the log file if the log file
function is supported
AHS-01 The tool reports to the user if any hidden sectors are found
AHS-02 The tool reports to the user that digital source may contain hidden sector but
undetected if the tool is unable to determine whether hidden sectors are
present due to incompatible execution environment
AHS-03 The tool reports to the user that hidden sectors will not be acquired if the tool
is unable to acquire hidden sectors due to incompatible execution
environment
Drive Model: ST380817AS (80GB)
Serial Number: 5MR18V18
Sector count: 156,301,488
Write blocker: N/A
Source hashes:
MD5 checksum: 69fdef5d5de3a207bc2a04017c38c3fd
SHA1 checksum: 9d768ab184ed9a172031f0f7b7f721f2bdf80b59
/dev/sdb: current max LBA: 94,863,828
/dev/sdb: native max LBA: 94,863,828
/dev/sdb: physical max LBA: 156,301,488
/dev/sdb: HPA not set
/dev/sdb: DCO set from sector 94,863,828 to 156,301,487
Device Start End #sectors File System
/dev/sdb1 63 41945714 41945652 NTFS
/dev/sdb2 41945715 94863824 52918110 Ext3
228