Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
2.13. TC-06-UNC<br />
Helix3 Pro R3 (Release Date: 30 th , Dec 2009)<br />
Test Case TC-06-UNC (Helix3 Pro 2009 R3)<br />
Test &<br />
Case<br />
Summary:<br />
Acquire a digital source that has at least one faulty data sector<br />
Notes: 15 UNC errors existed<br />
Assertion: AFR-01 The tool accesses the digital source with a supported access interface<br />
AFR-02 The tool acquires a digital source<br />
AFR-03 The tool operates in an execution environment<br />
AFR-04 The tool creates an image file <strong>of</strong> the digital source<br />
AFR-05 The tool acquires all the visible data sectors from the digital source<br />
AFR-07 All data sectors acquired from the digital source are acquired accurately.<br />
AFR-08<br />
The tool report to the user <strong>of</strong> the error type and the location <strong>of</strong> the error if<br />
error occurred during the reading from a digital source.<br />
AFR-09<br />
If there are unresolved errors reading from a digital source, then the tool<br />
uses a benign fill in the destination object in place <strong>of</strong> the inaccessible data.<br />
AIC-01<br />
The data represented by an image file is the same as the data acquired by<br />
the tool<br />
AIC-02<br />
The tool creates an image file according to the file <strong>for</strong>mat the user<br />
specified.<br />
AIC-03<br />
The tool reports to the user if an error occurs during the image creation<br />
Source<br />
Device:<br />
Drive<br />
Setup:<br />
AIC-06<br />
AIC-07<br />
AIC-08<br />
ALOG-01<br />
process.<br />
If the image file integrity check is selected, the tool shall report to the user<br />
the image file has not been changed if the image file has not been<br />
changed.<br />
If the image file integrity check is selected, the tool shall report to the user<br />
the image file has been changed if the image file has been changed.<br />
If the image file integrity check is selected, the tool shall report to the user<br />
the image file has been changed and the involved location if the image file<br />
has been changed.<br />
If the tool logs any in<strong>for</strong>mation regarding to the acquisition, the<br />
in<strong>for</strong>mation is accurately logged in the log file.<br />
ALOG-02 The tool display correct in<strong>for</strong>mation about the acquisition to the user.<br />
ALOG-03<br />
The tool display correct in<strong>for</strong>mation regarding to the acquisition to the<br />
user and the in<strong>for</strong>mation displayed is consistent with the log file if the log<br />
file function is supported<br />
Drive Model: ST380811 AS (80GB)<br />
Serial Number: 6PS2CA4Z<br />
Sector count: 156,296,385<br />
Write blocker: Tableau <strong>Forensic</strong> SATA/IDE Bridge IEEE 1394 SBP2 Device<br />
/dev/sdc: current max LBA: 156,296,385<br />
/dev/sdc: native max LBA: 156,296,385<br />
/dev/sdc: physical max LBA: 156,296,385<br />
/dev/sdc: HPA not set<br />
/dev/sdc: DCO not set<br />
Following sectors are marked as faulty:<br />
5161564, 12135645, 16429701, 28210195, 33486075, 40694940, 40828560,<br />
57691700, 90179820, 91800252, 92763320, 104129017, 109477200,<br />
118026966, 140386491<br />
232