Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Results by
assertion:
AIR 2.0.0 (Release Date: 17th, Feb 2010)
VERIFY SUCCESSFUL: Hashes match
Orig = md5 TOTAL: 554357b44e0334f254e80ab537a299c7
sha1 TOTAL: aa314705b7addb0bf230974b30967fa74082f490
Copy = md5 TOTAL: 554357b44e0334f254e80ab537a299c7
sha1 TOTAL: aa314705b7addb0bf230974b30967fa74082f490
Command completed: Wed Sep 1 00:27:06 NZST 2010
AFR-01 PASSED AIC-01 PASSED AHS-02 FAILED
AFR-02 PASSED AIC-02 PASSED AHS-03 FAILED
AFR-03 PASSED AIC-05 PASSED ALOG-01 PASSED
AFR-04 PASSED AIC-06 PASSED ALOG-02 PASSED
AFR-05 PASSED AIC-07 PASSED ALOG-03 PASSED
AFR-06 FAILED AIC-08 PASSED
AFR-07 PASSED AHS-01 FAILED
Analysis: Test FAILED to achieve the expected Result. AIR failed to detect and
acquire the hidden areas in the hard drive. Dc3dd command line option has
the ability of detect Hidden areas.
3.16. TC-12-02 Completely Hidden by HPA
Test Case TC-12-02 Completely Hidden by HPA (AIR 2.0.0)
Test &
Case
Summary:
Acquire a partition that is partially or completely hidden by HPA or DCO
Notes: FAT32 partition has been completely hidden by HPA from 149565150 to
156301487.
Assertion: AFR-01 The tool accesses the digital source with a supported access interface
AFR-02 The tool acquires a digital source
AFR-03 The tool operates in an execution environment
AFR-04 The tool creates an image file of the digital source
AFR-05 The tool acquires all the visible data sectors from the digital source
AFR-06 The tool acquires all the hidden data sectors from the digital source
AFR-07 All data sectors acquired from the digital source are acquired accurately.
AIC-01 The data represented by an image file is the same as the data acquired by the
tool
AIC-02 The tool creates an image file according to the file format the user specified.
AIC-05 If multi-file image creation and the image file size is selected, the tool creates
a multi-file image except that one file may be smaller
AIC-06 If the image file integrity check is selected, the tool shall report to the user the
image file has not been changed if the image file has not been changed.
AIC-07 If the image file integrity check is selected, the tool shall report to the user the
image file has been changed if the image file has been changed.
AIC-08 If the image file integrity check is selected, the tool shall report to the user the
image file has been changed and the involved location if the image file has
been changed.
ALOG- If the tool logs any information regarding to the acquisition, the information is
01
ALOG-
02
ALOG-
03
accurately logged in the log file.
The tool display correct information about the acquisition to the user. The
information about the acquisition at least including following: device, start
sector, end sector, type and number of errors encountered, and start time and
end time of acquisition.
The tool display correct information regarding to the acquisition to the user
and the information displayed is consistent with the log file if the log file
function is supported
AHS-01 The tool reports to the user if any hidden sectors are found
280