Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Also, MBR disks only support four primary partitions. In today‟s hardware products, 2
TB hard drives have become more affordable and common. It is only a matter of time,
when 2 TB or larger hard drives will become the mainstream products in the market.
In order to solve the limitations and problems with MBR, GPT is developed to replace
MBR partition tables. The maximum disk size can go up to 9.4 billion TB and it
supports 128 partitions by default. GPT also provides CRC32 checksums and backup
utility to maintain the integrity of the partition table and header. GPT is widely
supported by popular operating system vendors such as Apple OSX, Microsoft
Windows and Linux. GNOME Partition Editor (GParted) and Windows Disk
Management Tool support GPT creation and manipulation (Smith, 2009). GPT is
more popular in current Apple Intel-based computers. With millions of Apple Intel-
based computers have sold and the increasing usage of massive storage devices, GPT
will become the mainstream partition scheme.
What‟s the implication of GPT for forensic tools? The support of GPT in
forensic tools industry is still growing (Nikkel, 2009). Popular forensic tools such as
Encase and FTK can recognise and provide access to a GPT disk. However, more
improvements can be made to decode the GPT headers and entries, provide
information about the backup GPT and GPT checksums (Nikkel, 2009). Part of this
study aims at finding out whether the selected disk imaging tools are able to acquire a
GPT disk and partition in complete and accurate manner. Nikkel (2009) has described
that a full disk or a single partition acquisition can be done the same way as other
partition schemes (DOS or BSD) or traditional MBR partitions.
2.3.6 Problem Areas in Disk Imaging Tools - Hash Function
Cryptography Hash function has a wide range of applications. For example, it
identifies and classifies electronic information, authenticates data integrity and online
security. One-way hash function is commonly used as a method of authenticating and
verifying the integrity of electronic information. Hashing function has two very unique
characteristics that are concern of to digital forensics. Thompson (2005) explains that
it is computationally infeasible to derive or obtain any information about the original
contents from the hash value and to have two pieces of content that have the same
hash value. The hash function provided by the disk imaging software will ensure that
36