Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Results by<br />
assertion:<br />
Helix3 Pro R3 (Release Date: 30 th , Dec 2009)<br />
size 80026361856<br />
ansiversion 5<br />
signature 00055737<br />
Whole<strong>Disk</strong> True<br />
VendorName ATA ST380817AS<br />
ACQUISITION INFORMATION<br />
Acquire Format: RAW<br />
Acquisition Start: 2010-09-08 08:05:09<br />
Acquisition Stop 2010-09-08 09:29:39<br />
Output File(s):<br />
/mnt/Image/Helix3-OverlappingPartition-Nowriteblock.001<br />
/mnt/Image/Helix3-OverlappingPartition-Nowriteblock.002<br />
………………………………….<br />
/mnt/Image/Helix3-OverlappingPartition-Nowriteblock.038<br />
Verification: Passed<br />
Hash(es):<br />
MD5: 3170cec7e6720af973cc37a946c32ae3<br />
SHA1: 6366ad8cd563c05f086dfe7b7884b08fd9795069<br />
AFR-01 PASSED AIC-01 PASSED<br />
AFR-02 PASSED AIC-02 PASSED<br />
AFR-03 PASSED AIC-11 FAILED<br />
AFR-04 PASSED ALOG-01 PASSED<br />
AFR-05 PASSED ALOG-02 FAILED<br />
AFR-07 PASSED ALOG-03 PASSED<br />
Analysis: Test FAILED to achieve the expected Result. Helix 3 pro is unable to<br />
recover the partition table and the irregularity <strong>of</strong> the partition table is not<br />
reported to the user. The image is acquired correctly.<br />
2.18. TC-14 Partition out <strong>of</strong> boundary<br />
Test Case TC-14 Partition out <strong>of</strong> boundary (Helix3 Pro 2009 R3)<br />
Test &<br />
Case<br />
Summary:<br />
Acquire a hard disk with a partition‟s end address ended outside the physical<br />
boundary<br />
Notes: Partitions ended out <strong>of</strong> the physical boundary <strong>of</strong> the disk. The last partition end<br />
sector changed from 72,331,264 to 72,380,000.<br />
Assertions: AFR-01 The tool accesses the digital source with a supported access interface<br />
AFR-02 The tool acquires a digital source<br />
AFR-03 The tool operates in an execution environment<br />
AFR-04 The tool creates an image file <strong>of</strong> the digital source<br />
AFR-05 The tool acquires all the visible data sectors from the digital source<br />
AFR-07 All data sectors acquired from the digital source are acquired accurately.<br />
AIC-01<br />
The data represented by an image file is the same as the data acquired by the<br />
tool<br />
AIC-02 The tool creates an image file according to the file <strong>for</strong>mat the user specified.<br />
AIC-11 The tool reports to the user if any irregularities found in the digital source.<br />
ALOG- If the tool logs any in<strong>for</strong>mation regarding to the acquisition, the in<strong>for</strong>mation is<br />
01<br />
ALOG-<br />
02<br />
accurately logged in the log file.<br />
The tool display correct in<strong>for</strong>mation about the acquisition to the user. The<br />
in<strong>for</strong>mation about the acquisition at least including following: device, start<br />
240
Change language