Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Results by<br />
assertion:<br />
AIR 2.0.0 (Release Date: 17th, Feb 2010)<br />
hashlog=/tmp/verify_hash.log status=noxfer <strong>of</strong>=/dev/null<br />
VERIFY SUCCESSFUL: Hashes match<br />
Orig = md5 TOTAL: 4e1e7f58383e4d89b6357293005cd1b3<br />
sha512 TOTAL:<br />
90801655cc2632352406b44e591eb1569fca6e16844a5bc9e1c01b0a80101d<br />
585be0e5d443047f57ebe95acb2a59387c87428b1239e9bcd1748ad8151633<br />
af81<br />
Copy = md5 TOTAL: 4e1e7f58383e4d89b6357293005cd1b3<br />
sha512 TOTAL:<br />
90801655cc2632352406b44e591eb1569fca6e16844a5bc9e1c01b0a80101d<br />
585be0e5d443047f57ebe95acb2a59387c87428b1239e9bcd1748ad8151633<br />
af81<br />
Command completed: Tue Jul 27 03:34:47 NZST 2010<br />
AFR-01 PASSED AIC-01 PASSED<br />
AFR-02 PASSED AIC-05 PASSED<br />
AFR-03 PASSED ALOG-01 PASSED<br />
AFR-04 PASSED ALOG-02 PASSED<br />
AFR-05 PASSED ALOG-03 PASSED<br />
AFR-07 PASSED<br />
Analysis: Test achieved the expected Result. Source hashes match verification<br />
hashes.<br />
3.8. TC-02-HFS<br />
Test Case TC-02-HFS (AIR 2.0.0)<br />
Test &<br />
Case<br />
Summary:<br />
Acquire a digital source that supported by the tools to an image file<br />
Notes: Acquire Mac partition type HFS partition only<br />
Assertion: AFR-01 The tool accesses the digital source with a supported access<br />
interface<br />
AFR-02 The tool acquires a digital source<br />
AFR-03 The tool operates in an execution environment<br />
AFR-04 The tool creates an image file <strong>of</strong> the digital source<br />
AFR-05 The tool acquires all the visible data sectors from the digital<br />
source<br />
AFR-07 All data sectors acquired from the digital source are acquired<br />
accurately.<br />
AIC-01 The data represented by an image file is the same as the data<br />
acquired by the tool<br />
AIC-05 If multi-file image creation and the image file size is selected,<br />
the tool creates a multi-file image except that one file may be<br />
smaller<br />
ALOG-01 If the tool logs any in<strong>for</strong>mation regarding to the acquisition,<br />
the in<strong>for</strong>mation is accurately logged in the log file.<br />
ALOG-02 The tool display correct in<strong>for</strong>mation about the acquisition to<br />
the user.<br />
ALOG-03 The tool display correct in<strong>for</strong>mation regarding to the<br />
acquisition to the user and the in<strong>for</strong>mation displayed is<br />
consistent with the log file if the log file function is supported<br />
265
Change language