Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Results by
assertion:
AIR 2.0.0 (Release Date: 17th, Feb 2010)
sha1 TOTAL: e878400c062b1690b586be41523d303edf3eae52
10801152+0 sectors in
10801152+0 sectors out
Command completed: Fri Oct 1 10:15:47 NZDT 2010
Start VERIFY: Fri Oct 1 10:15:47 NZDT 2010
cat /mnt/new/Image/AIR_HFSplus.* | air-counter 2>>
/usr/local/share/air/logs/air.buffer.data | dc3dd hash=md5,sha1
hashlog=/tmp/verify_hash.log status=noxfer of=/dev/null
VERIFY SUCCESSFUL: Hashes match
Orig = md5 TOTAL: 5781d0f597685d4eff4cc3423900d73a
sha1 TOTAL: e878400c062b1690b586be41523d303edf3eae52
Copy = md5 TOTAL: 5781d0f597685d4eff4cc3423900d73a
sha1 TOTAL: e878400c062b1690b586be41523d303edf3eae52
Command completed: Fri Oct 1 10:19:59 NZDT 2010
AFR-01 PASSED AIC-01 PASSED
AFR-02 PASSED AIC-05 PASSED
AFR-03 PASSED ALOG-01 PASSED
AFR-04 PASSED ALOG-02 PASSED
AFR-05 PASSED ALOG-03 PASSED
AFR-07 PASSED
Analysis: Test achieved the expected Result. Source hashes match verification
hashes.
3.10. TC-03-HPA
Test Case TC-03-HPA (AIR 2.0.0)
Test &
Case
Summary:
Acquire a hard drive with hidden sectors to an image file
Notes: HPA active
Assertion: AFR-01 The tool accesses the digital source with a supported access interface
AFR-02 The tool acquires a digital source
AFR-03 The tool operates in an execution environment
AFR-04 The tool creates an image file of the digital source
AFR-05 The tool acquires all the visible data sectors from the digital source
AFR-06 The tool acquires all the hidden data sectors from the digital source
AFR-07 All data sectors acquired from the digital source are acquired accurately.
AIC-01
The data represented by an image file is the same as the data acquired by the
tool
AIC-02 The tool creates an image file according to the file format the user specified.
AIC-05
If multi-file image creation and the image file size is selected, the tool creates
a multi-file image except that one file may be smaller
AIC-06
If the image file integrity check is selected, the tool shall report to the user the
image file has not been changed if the image file has not been changed.
AIC-07
If the image file integrity check is selected, the tool shall report to the user the
AIC-08
ALOG-
01
ALOG-
02
image file has been changed if the image file has been changed.
If the image file integrity check is selected, the tool shall report to the user the
image file has been changed and the involved location if the image file has
been changed.
If the tool logs any information regarding to the acquisition, the information is
accurately logged in the log file.
The tool display correct information about the acquisition to the user. The
information about the acquisition at least including following: device, start
sector, end sector, type and number of errors encountered, and start time and
end time of acquisition.
268