Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Source
Device:
Drive
Setup:
Partition
Table:
Log
highlights:
Results by
assertion:
Helix3 Pro R3 (Release Date: 30 th , Dec 2009)
environment
Drive Model: ST380817AS (80GB)
Serial Number: 5MR18V18
Sector count: 156,301,488
Write blocker: N/A
/dev/sdb: current max LBA: 150,301,484
/dev/sdb: native max LBA: 150,301,484
/dev/sdb: physical max LBA: 156,301,488
/dev/sdb: HPA set from sector 6,301,488 to 156,301,487
(Total 150,000,000 sectors)
Device Start End #sectors File System
/dev/sdb1 4096 2101247 2097152 FAT32
/dev/sdb2 2101248 6297599 4196352 NTFS
/dev/sdb3 6297600 156301311 150003712 NTFS (Partially
HPA)
Created By Helix3 Pro 2009R3
OS Name Windows Vista
OS Mode Workstation
OS Build 6.1.7600
Administrator True
physical True
size 3224567808
name PhysicalDrive1
mount PhysicalDrive1
serialnumber 5MR18V18
system ST380817AS
firmware 3.42 T
type Fixed hard disk
WholeDisk True
Acquire Format: RAW
Acquisition Start: 2010-10-17 09:19:51
Acquisition Stop 2010-10-17 09:21:28
E:\Image\Helix_PartHPA_Test2.001
E:\Image\Helix_PartHPA_Test2.002
Verification: Passed
MD5: 203a251380ef3fe11a6ab0c8ead814ee
SHA1: e01ef3dcbcc9851b40cb64b52f0ba1d89bef3cf6
AFR-01 PASSED AIC-01 PASSED AHS-02 PASSED
AFR-02 PASSED AIC-02 PASSED AHS-03 PASSED
AFR-03 PASSED AIC-05 PASSED ALOG-01 FAILED
AFR-04 PASSED AIC-06 PASSED ALOG-02 PASSED
AFR-05 PASSED AIC-07 PASSED ALOG-03 PASSED
AFR-06 PASSED AIC-08 PASSED
AFR-07 PASSED AHS-01 PASSED
Analysis: Test FAILED to achieve the expected Result. The logged size information
of the hard disk is inaccurate. The correct size of the visible data is
3,226,361,856 bytes instead. However, the total amount of data acquired is
correct and complete.
238