Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Partition
Table:
Log
highlights:
Results by
assertion:
AIR 2.0.0 (Release Date: 17th, Feb 2010)
/dev/sdb: current max LBA: 156,301,488
/dev/sdb: native max LBA: 156,301,488
/dev/sdb: physical max LBA: 156,301,488
/dev/sdb: HPA and DCO are not set
Device Start End #sectors System
/dev/sdb1 63 2104514 2104452 FAT32
/dev/sdb2 2104515 6297479 4192965 NTFS
/dev/sdb3 6297480 156296384 149998905 NTFS
Start DC3DD (md5 sha1): Sun Oct 17 16:32:52 NZDT 2010
Hash will be calculated on port:5058.
command line: dc3dd hash=md5,sha1 hashlog=/tmp/hash.log status=noxfer
of=/root/AIR_Network seek=0 obs=32768
compiled options: DEFAULT_BLOCKSIZE=32768
md5 TOTAL: 14d2c1027467bc11c8405c0ff961f2e4
sha1 TOTAL: 583d77bf05a1b12600eaa4100b740459dda34308
2104452+0 sectors in
2104452+0 sectors out
Command completed: Sun Oct 17 16:36:23 NZDT 2010
Start VERIFY: Sun Oct 17 16:36:23 NZDT 2010
Command-line: dc3dd if=/root/AIR_Network hash=md5,sha1
conv=noerror,sync hashlog=/tmp/verify_hash.log status=noxfer | air-counter
2>> /usr/local/share/air/logs/air.buffer.data > /dev/null
VERIFY SUCCESSFUL: Hashes match
Orig = md5 TOTAL: 14d2c1027467bc11c8405c0ff961f2e4
sha1 TOTAL: 583d77bf05a1b12600eaa4100b740459dda34308
Copy = md5 TOTAL: 14d2c1027467bc11c8405c0ff961f2e4
sha1 TOTAL: 583d77bf05a1b12600eaa4100b740459dda34308
Command completed: Sun Oct 17 16:36:44 NZDT
AFR-01 PASSED AIC-01 PASSED ALOG-01 PASSED
AFR-02 PASSED AIC-02 PASSED ALOG-02 PASSED
AFR-03 PASSED AIC-05 PASSED ALOG-03 PASSED
AFR-04 PASSED AIC-06 PASSED
AFR-05 PASSED AIC-07 PASSED
AFR-07 PASSED AIC-08 PASSED
Analysis: Test achieved expected result.
292