Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

2.12. TC-05-EnCase6
Helix3 Pro R3 (Release Date: 30 th , Dec 2009)
Test Case TC-05-EnCase 6 (Helix3 Pro 2009 R3)
Test &
Case
Summary:
TC-05 Acquire a digital source to an image file in an alternate supported
format
Notes: Convert images from test002 Hard drive to Encase 6 format to see
whether helix can output other type of images except dd.
Assertion: AFR-01 The tool accesses the digital source with a supported access
interface
AFR-02 The tool acquires a digital source
AFR-03 The tool operates in an execution environment
AFR-04 The tool creates an image file of the digital source
AFR-05 The tool acquires all the visible data sectors from the digital
source
AFR-07 All data sectors acquired from the digital source are acquired
accurately.
AIC-01 The data represented by an image file is the same as the data
acquired by the tool.
AIC-02 The tool creates an image file according to the file format the
user specified.
ALOG-01 If the tool logs any information regarding to the acquisition,
the information is accurately logged in the log file.
ALOG-02 The tool display correct information about the acquisition to
the user.
ALOG-03 The tool display correct information regarding to the
acquisition to the user and the information displayed is
Source
Device:
Drive
Setup:
consistent with the log file if the log file function is supported
Drive Model: ST380811 AS (80GB)
Serial Number: 6PS2CA4Z
Sector count: 156,296,385
Write blocker: Tableau Forensic SATA/IDE Bridge IEEE 1394 SBP2
Device
/dev/sdc: current max LBA: 156,296,385
/dev/sdc: native max LBA: 156,296,385
/dev/sdc: physical max LBA: 156,296,385
/dev/sdc: HPA not set
/dev/sdc: DCO not set
230