Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Source
Device:
Drive
Setup:
Partition
Table
(GPT
disk):
Log
highlights:
Helix3 Pro R3 (Release Date: 30 th , Dec 2009)
02 information about the acquisition at least including following: device, start
sector, end sector, type and number of errors encountered, and start time and
ALOG-
03
end time of acquisition.
The tool display correct information regarding to the acquisition to the user
and the information displayed is consistent with the log file if the log file
function is supported
Drive Model: ST380817AS (80GB)
Serial Number: 5MR18V18
Sector count: 156,301,488
Write blocker: Tableau Forensic SATA/IDE Bridge IEEE 1394 SBP2
Device
Source Hashes:
MD5: 7a84a94aae46d34ac61dc26800f6dd19
SHA1: f913fd6832de537c78dc4da881281984daed37f5
/dev/sdb: current max LBA: 156,301,488
/dev/sdb: native max LBA: 156,301,488
/dev/sdb: physical max LBA: 156,301,488
/dev/sdb: HPA and DCO are not set
Device Start End #sectors File System
/dev/sdb1 34 262110 262144 Microsoft
Reserved
/dev/sdb2 264192 8652799 8388608 NTFS
/dev/sdb3 8652800 12847103 4194304 NTFS
/dev/sdb4 12847104 14944255 2097152 NTFS
/dev/sdb5 14944256 25380863 10436608 NTFS
/dev//sdb6 25380864 156299264 130918400 NTFS
Created By Helix3 Pro 2009R3
OS Name Windows XP
OS Patch Service Pack 3
Administrator True
physical True
size 80023749120
serialnumber 3.42
firmware ST380817
type Fixed hard disk
WholeDisk True
Acquire Format: RAW
Acquisition Start: 2010-09-17 01:44:28
Acquisition Stop 2010-09-17 06:01:05
Output File(s):
G:\Image\Helix3-GUID.001
G:\Image\Helix3-GUID.002
………………………
G:\Image\Helix3-GUID.038
Verification: Passed
Hash(es):
MD5: 7a84a94aae46d34ac61dc26800f6dd19
SHA1: f913fd6832de537c78dc4da881281984daed37f5
246