Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Source
Device:
Drive
Setup:
Partition
Table:
Log
highlights:
Results by
assertion:
AIR 2.0.0 (Release Date: 17th, Feb 2010)
AHS-02 The tool reports to the user that digital source may contain hidden sector but
undetected if the tool is unable to determine whether hidden sectors are
present due to incompatible execution environment
AHS-03 The tool reports to the user that hidden sectors will not be acquired if the tool
is unable to acquire hidden sectors due to incompatible execution
environment
Drive Model: ST380817AS (80GB)
Serial Number: 5MR18V18
Sector count: 156,301,488
Write blocker: N/A
/dev/sdb: current max LBA: 149,565,150
/dev/sdb: native max LBA: 149,565,150
/dev/sdb: physical max LBA: 156,301,488
/dev/sdb: HPA set from sector 149,565,150 to 156,301,487 (Total
6,736,337 sectors)
Device Start End #sectors File System
/dev/sdb1 63 2104514 2104452 NTFS
/dev/sdb2 2104515 149565149 145460535 Ext3
/dev/sdb3 149565150 156296384 6731234 FAT32 (Entire
HPA)
Start DC3DD (md5 sha1): Wed Sep 1 02:36:13 NZST 2010
dc3dd hash=md5,sha1 hashlog=/tmp/hash.log status=noxfer if=/dev/sda3
skip=0 conv=noerror,sync iflag=direct ibs=32768 2>>
/usr/local/share/air/logs/air.image.log | air-counter 2>>
/usr/local/share/air/logs/air.buffer.data | /usr/local/bin/split -a 3 -d -b 2047m -
/mnt/new/Image/partition_whole_HPA. >>
/usr/local/share/air/logs/air.image.log 2>&1
dc3dd: opening `/dev/sda3': No such file or directory
Command completed: Wed Sep 1 02:36:16 NZST 2010
Start VERIFY: Wed Sep 1 02:36:16 NZST 2010
Command-line: cat /mnt/new/Image/partition_whole_HPA.* | air-counter
2>> /usr/local/share/air/logs/air.buffer.data | dc3dd hash=md5,sha1
hashlog=/tmp/verify_hash.log status=noxfer of=/dev/null
VERIFY FAILED: Hashes don't match
Orig =
Copy = md5 TOTAL: d41d8cd98f00b204e9800998ecf8427e
sha1 TOTAL: da39a3ee5e6b4b0d3255bfef95601890afd80709
Command completed: Wed Sep 1 02:36:19 NZST 2010
AFR-01 PASSED AIC-01 PASSED AHS-02 FAILED
AFR-02 PASSED AIC-02 PASSED AHS-03 FAILED
AFR-03 PASSED AIC-05 PASSED ALOG-01 PASSED
AFR-04 PASSED AIC-06 PASSED ALOG-02 PASSED
AFR-05 PASSED AIC-07 PASSED ALOG-03 PASSED
AFR-06 FAILED AIC-08 PASSED
AFR-07 PASSED AHS-01 FAILED
Analysis: Test FAILED to achieve the expected Result. AIR failed to detect and
acquire the hidden areas in the hard drive. AIR stopped immediately when
attempting to acquire the hidden partition and indicated no such file or
directory in the partition.
281