Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Log
highlights:
AIR 2.0.0 (Release Date: 17th, Feb 2010)
Start DC3DD (md5 sha512): Tue Jul 27 02:57:07 NZST 2010
Hash will be calculated on /dev/sdc1.
dc3dd 6.12.4 started at 2010-07-27 02:57:07 +1200
command line: dc3dd hash=md5,sha512 hashlog=/tmp/hash.log status=noxfer
if=/dev/sdc1 skip=0 conv=noerror iflag=direct ibs=32768
compiled options: DEFAULT_BLOCKSIZE=32768
sector size: 512 (assumed)
md5 TOTAL: d48a1018a5fbb72b40d36da51e396eb3
sha512 TOTAL:
ff3a752011324ca7b70219c03e230051235aa3cf3a3097698f8a879be9f8e08a64
de7b791e185fa19f58905a2496955302da4a775d31ddaefe26cf31a5e6956f
6297417+0 sectors in
6297417+0 sectors out
Command completed: Tue Jul 27 03:02:10 NZST 2010
Start VERIFY: Tue Jul 27 03:02:10 NZST 2010
Command-line: cat /mnt/new/new/Test002/Test002_AIR_NTFS.* | aircounter
2>> /usr/local/share/air/logs/air.buffer.data | dc3dd hash=md5,sha512
hashlog=/tmp/verify_hash.log status=noxfer of=/dev/null
VERIFY SUCCESSFUL: Hashes match
Orig = md5 TOTAL: d48a1018a5fbb72b40d36da51e396eb3
sha512 TOTAL:
ff3a752011324ca7b70219c03e230051235aa3cf3a3097698f8a879be9f8e08a64
de7b791e185fa19f58905a2496955302da4a775d31ddaefe26cf31a5e6956f
Copy = md5 TOTAL: d48a1018a5fbb72b40d36da51e396eb3
sha512 TOTAL:
ff3a752011324ca7b70219c03e230051235aa3cf3a3097698f8a879be9f8e08a64
de7b791e185fa19f58905a2496955302da4a775d31ddaefe26cf31a5e6956f
Command completed: Tue Jul 27 03:07:19 NZST 2010
Results by AFR-01 PASSED AIC-01 PASSED
assertion: AFR-02 PASSED AIC-05 PASSED
AFR-03 PASSED ALOG-01 PASSED
AFR-04 PASSED ALOG-02 PASSED
AFR-05 PASSED ALOG-03 PASSED
AFR-07 PASSED
Analysis: Test achieved the expected Result. Source hashes match verification hashes.
257