Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Source
Device:
Drive
Setup:
Partition
Table:
Log
highlights:
AIR 2.0.0 (Release Date: 17th, Feb 2010)
AFR-09
error occurred during the reading from a digital source.
If there are unresolved errors reading from a digital source, then the tool uses
a benign fill in the destination object in place of the inaccessible data.
AIC-01
The data represented by an image file is the same as the data acquired by the
tool
AIC-02 The tool creates an image file according to the file format the user specified.
AIC-03
The tool reports to the user if an error occurs during the image creation
process.
AIC-05
If multi-file image creation and the image file size is selected, the tool creates
a multi-file image except that one file may be smaller
AIC-06
If the image file integrity check is selected, the tool shall report to the user the
image file has not been changed if the image file has not been changed.
AIC-07
If the image file integrity check is selected, the tool shall report to the user the
image file has been changed if the image file has been changed.
If the image file integrity check is selected, the tool shall report to the user the
AIC-08 image file has been changed and the involved location if the image file has
been changed.
AIC-11 The tool reports to the user if any irregularities found in the digital source.
ALOG- If the tool logs any information regarding to the acquisition, the information is
01 accurately logged in the log file.
The tool display correct information about the acquisition to the user. The
ALOG- information about the acquisition at least including following: device, start
02 sector, end sector, type and number of errors encountered, and start time and
end time of acquisition.
ALOG-
03
The tool display correct information regarding to the acquisition to the user
and the information displayed is consistent with the log file if the log file
function is supported
Drive Model: ST380817AS (80GB)
Serial Number: 5MR18V18
Sector count: 156,301,488
Write blocker: Tableau Forensic SATA/IDE Bridge IEEE 1394 SBP2
Device
/dev/sdb: current max LBA: 156,301,488
/dev/sdb: native max LBA: 156,301,488
/dev/sdb: physical max LBA: 156,301,488
/dev/sdb: HPA and DCO are not set
Device Start End #sectors File System
/dev/sdb1 2048 40962047 40960000 NTFS
/dev/sdb2 40962048 83970047 43008000 Ext4
/dev/sdb3 83972096 156301311 72329125 Extended
Start DC3DD (md5 sha1): Mon Sep 13 18:34:06 NZST 2010
command line: dc3dd hash=md5,sha1 hashlog=/tmp/hash.log status=noxfer
if=/dev/sdc skip=0 conv=noerror,sync iflag=direct ibs=32768
compiled options: DEFAULT_BLOCKSIZE=32768
sector size: 512 (assumed)
md5 TOTAL: 2ab63e47f402406afed31dad063df7f8
sha1 TOTAL: d337f09ba2b9069668c70a14a2fc87a3b21a5887
156301488+0 sectors in
156301488+0 sectors out
dc3dd completed at 2010-09-13 19:56:20 +1200
Command completed: Mon Sep 13 19:56:24 NZST 2010
Start VERIFY: Mon Sep 13 19:56:24 NZST 2010
Command-line: cat /mnt/new/Image/Caine_UnReadableMBR.* | air-counter
2>> /usr/local/share/air/logs/air.buffer.data | dc3dd hash=md5,sha1
285