Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Drive
Setup:
Partition
Table:
Log
highlights:
AIR 2.0.0 (Release Date: 17th, Feb 2010)
Sector count: 156,301,488
Write blocker: N/A
Source hashes
MD5 checksum: 69fdef5d5de3a207bc2a04017c38c3fd
SHA1 checksum: 9d768ab184ed9a172031f0f7b7f721f2bdf80b59
/dev/sdb: current max LBA: 94,863,828
/dev/sdb: native max LBA: 94,863,828
/dev/sdb: physical max LBA: 156,301,488
/dev/sdb: HPA not set
/dev/sdb: DCO set from sector 94,863,828 to 156,301,487
Device Start End #sectors File System
/dev/sdb1 63 41945714 41945652 NTFS
/dev/sdb2 41945715 94863824 52918110 Ext3
/dev/sdb3 94863825 156296384 61432560 NTFS
271
(DCO)
Start DC3DD (md5 sha512): Mon Jul 26 02:57:13 NZST 2010
dc3dd 6.12.4 started at 2010-07-26 02:57:13 +1200
command line: dc3dd hash=md5,sha512 hashlog=/tmp/hash.log status=noxfer
if=/dev/sda skip=0 conv=noerror iflag=direct ibs=32768
compiled options: DEFAULT_BLOCKSIZE=32768
sector size: 512 (assumed)
md5 TOTAL: 69fdef5d5de3a207bc2a04017c38c3fd
sha512 TOTAL:
4ad5009bfc6232521fd893ad7d8cc7e0d592aa5de8cb6904b8d189664656ec517
cc0e31fb57a93d034a3c23498c1494d54e2488835c2b6c3588b3607af48ad5f
94868928+0 sectors in
94868928+0 sectors out
dc3dd completed at 2010-07-26 04:16:50 +1200
Command completed: Mon Jul 26 04:16:53 NZST 2010
Start VERIFY: Mon Jul 26 04:16:53 NZST 2010
Command-line: cat /mnt/dconew/new/ST380817AS_DCO_94868928.* | aircounter
2>> /usr/local/share/air/logs/air.buffer.data | dc3dd hash=md5,sha512
hashlog=/tmp/verify_hash.log status=noxfer of=/dev/null
VERIFY SUCCESSFUL: Hashes match
Orig = md5 TOTAL: 69fdef5d5de3a207bc2a04017c38c3fd
sha512 TOTAL:
4ad5009bfc6232521fd893ad7d8cc7e0d592aa5de8cb6904b8d189664656ec517
cc0e31fb57a93d034a3c23498c1494d54e2488835c2b6c3588b3607af48ad5f
Copy = md5 TOTAL: 69fdef5d5de3a207bc2a04017c38c3fd
sha512 TOTAL:
4ad5009bfc6232521fd893ad7d8cc7e0d592aa5de8cb6904b8d189664656ec517
cc0e31fb57a93d034a3c23498c1494d54e2488835c2b6c3588b3607af48ad5f
Command completed: Mon Jul 26 05:50:14 NZST 2010