Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Source
Device:
Drive
Setup:
Partition
Table:
Log
highlights:
ALOG-
03
Helix3 Pro R3 (Release Date: 30 th , Dec 2009)
The tool display correct information regarding to the acquisition to the user
and the information displayed is consistent with the log file if the log file
function is supported
Drive Model: ST380817AS (80GB)
Serial Number: 5MR18V18
Sector count: 156,301,488
Write blocker: Tableau Forensic SATA/IDE Bridge IEEE 1394 SBP2
Device
/dev/sdb: current max LBA: 156,301,488
/dev/sdb: native max LBA: 156,301,488
/dev/sdb: physical max LBA: 156,301,488
/dev/sdb: HPA and DCO are not set
Device Start End #sectors File System
/dev/sdb1 2048 40962047 40960000 NTFS
/dev/sdb2 40962048 83970047 43008000 Ext4
/dev/sdb3 83972096 156301311 72329125 Extended
Created By Helix3 Pro 2009R3
SYSTEM INFORMATION
OS Name Windows XP
OS Mode Workstation
OS Patch Service Pack 3
OS Build 5.1.2600
Computer Name JAMES-212DFE2EF
User Name Administrator
Administrator True
NIC 1 - IP 192.168.182.134
NIC 1 - MAC 00:0C:29:E1:F8:FA
NIC 1 - Subnet 255.255.255.0
DISK INFORMATION
physical True
size 80023749120
name PhysicalDrive2
mount PhysicalDrive2
serialnumber 3.42
system AS
firmware ST380817
type Fixed hard disk
WholeDisk True
ACQUISITION INFORMATION
Acquire Format: RAW
Acquisition Start: 2010-09-12 23:58:54
Acquisition Stop 2010-09-13 04:17:59
Output File(s):
G:\Image\Helix-UnReadableMBR.001
G:\Image\Helix-UnReadableMBR.002
……………………………..
G:\Image\Helix-UnReadableMBR.038
Verification: Passed
Hash(es):
MD5: 2ab63e47f402406afed31dad063df7f8
SHA1: d337f09ba2b9069668c70a14a2fc87a3b21a5887
243