Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

3.21. TC-16-02 Acquire a GPT disk
AIR 2.0.0 (Release Date: 17th, Feb 2010)
Test Case TC-16-02 Acquire a GPT disk (AIR 2.0.0)
Test &
Case
Summary:
Acquire a GPT disk
Notes: Hard drive partitioned as GPT disk. 6 partitions are created.
Assertions: AFR-01 The tool accesses the digital source with a supported access interface
AFR-02 The tool acquires a digital source
AFR-03 The tool operates in an execution environment
AFR-04 The tool creates an image file of the digital source
AFR-05 The tool acquires all the visible data sectors from the digital source
Source
Device:
Drive
Setup:
Partition
Table
(GPT
disk):
Log
highlights:
AFR-07 All data sectors acquired from the digital source are acquired accurately.
AIC-01
The data represented by an image file is the same as the data acquired by the
tool
AIC-02 The tool creates an image file according to the file format the user specified.
AIC-05
If multi-file image creation and the image file size is selected, the tool creates
a multi-file image except that one file may be smaller
AIC-06
If the image file integrity check is selected, the tool shall report to the user the
image file has not been changed if the image file has not been changed.
AIC-07
If the image file integrity check is selected, the tool shall report to the user the
AIC-08
ALOG-
01
ALOG-
02
ALOG-
03
image file has been changed if the image file has been changed.
If the image file integrity check is selected, the tool shall report to the user the
image file has been changed and the involved location if the image file has
been changed.
If the tool logs any information regarding to the acquisition, the information is
accurately logged in the log file.
The tool display correct information about the acquisition to the user. The
information about the acquisition at least including following: device, start
sector, end sector, type and number of errors encountered, and start time and
end time of acquisition.
The tool display correct information regarding to the acquisition to the user
and the information displayed is consistent with the log file if the log file
function is supported
Drive Model: ST380817AS (80GB)
Serial Number: 5MR18V18
Sector count: 156,301,488
Write blocker: Tableau Forensic SATA/IDE Bridge IEEE 1394 SBP2
Device
/dev/sdb: current max LBA: 156,301,488
/dev/sdb: native max LBA: 156,301,488
/dev/sdb: physical max LBA: 156,301,488
/dev/sdb: HPA and DCO are not set
Device Start End #sectors File System
/dev/sdb1 34 262110 262144 Microsoft
Reserved
/dev/sdb2 264192 8652799 8388608 NTFS
/dev/sdb3 8652800 12847103 4194304 NTFS
/dev/sdb4 12847104 14944255 2097152 NTFS
/dev/sdb5 14944256 25380863 10436608 NTFS
/dev/sdb6 25380864 156299264 130918400 NTFS
Start DC3DD (md5 sha1): Fri Sep 17 17:48:35 NZST 2010
command line: dc3dd hash=md5,sha1 hashlog=/tmp/hash.log status=noxfer
if=/dev/sdc skip=0 conv=noerror,sync iflag=direct ibs=32768
compiled options: DEFAULT_BLOCKSIZE=32768
sector size: 512 (assumed)
288