Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

3.17. TC-13 Overlapping Partitions
AIR 2.0.0 (Release Date: 17th, Feb 2010)
Test Case TC-13 Overlapping Partitions (AIR 2.0.0)
Test &
Case
Summary:
TC-13 Acquire a partition that is overlapping with another partition
Notes: Partitions are overlapped. The last NTFS partition started before the end of the last
partition. Starting sector changed from 79,168,320 to 79,100,000.
Assertions: AFR-01 The tool accesses the digital source with a supported access interface
AFR-02 The tool acquires a digital source
AFR-03 The tool operates in an execution environment
AFR-04 The tool creates an image file of the digital source
AFR-05 The tool acquires all the visible data sectors from the digital source
AFR-07 All data sectors acquired from the digital source are acquired accurately.
AIC-01 The data represented by an image file is the same as the data acquired by the
tool
AIC-02 The tool creates an image file according to the file format the user specified.
AIC-11 The tool reports to the user if any irregularities found in the digital source.
ALOG- If the tool logs any information regarding to the acquisition, the information is
Source
Device:
Drive
Setup:
Partition
Table:
Log
highlights:
01
ALOG-
02
ALOG-
03
accurately logged in the log file.
The tool display correct information about the acquisition to the user. The
information about the acquisition at least including following: device, start
sector, end sector, type and number of errors encountered, and start time and
end time of acquisition.
The tool display correct information regarding to the acquisition to the user
and the information displayed is consistent with the log file if the log file
function is supported
Drive Model: ST380817AS (80GB)
Serial Number: 5MR18V18
Sector count: 156,301,488
Write blocker: Tableau Forensic SATA/IDE Bridge IEEE 1394 SBP2
Device
Source Hashes:
md5: 3170cec7e6720af973cc37a946c32ae3
sha1: 6366ad8cd563c05f086dfe7b7884b08fd9795069
/dev/sdb: current max LBA: 156,301,488
/dev/sdb: native max LBA: 156,301,488
/dev/sdb: physical max LBA: 156,301,488
/dev/sdb: HPA and DCO are not set
Device Start End #sectors File System
/dev/sdb1 63 20980764 20980827 NTFS
/dev/sdb2 20980890 79168320 58187430 Ext3
/dev/sdb3 79100000 156296385 77128065 NTFS (Modified)
Start DC3DD (md5 sha1): Wed Sep 8 06:58:56 NZST 2010
dc3dd hash=md5,sha1 hashlog=/tmp/hash.log status=noxfer if=/dev/sdb
skip=0 conv=noerror,sync iflag=direct ibs=32768
md5 TOTAL: 3170cec7e6720af973cc37a946c32ae3
sha1 TOTAL: 6366ad8cd563c05f086dfe7b7884b08fd9795069
156301488+0 sectors in
156301488+0 sectors out
Command completed: Wed Sep 8 08:20:42 NZST 2010
Start VERIFY: Wed Sep 8 08:20:42 NZST 2010
Command-line: cat /mnt/new/Image/caine-overlapPartition.* | air-counter
2>> /usr/local/share/air/logs/air.buffer.data | dc3dd hash=md5,sha1
hashlog=/tmp/verify_hash.log status=noxfer of=/dev/null
282