Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

cases TC-01, TC-02, TC-05, TC-07, TC-11 and TC-17 are the examples that followed
the generic procedures (see Appendix 4). However, some test cases were setup and
configured differently than the others. Test cases TC-03, TC-12 and TC-16 were
required to setup hidden sectors in the test drive after the drive was partitioned.
HDAT2 was used to configure HPA and/or DCO hidden areas in the test drive (see
Appendix 4.4). TC-06 used a tool called MHDD to emulate uncorrectable (UNC) data
error in particular sectors of the test drive. TC-15 is a test case that used Hex editor to
corrupt the data in the Master Boot Record (MBR) of the test drive. A DOS-based
partition editor was used in test case TC-13 to create the status known as “partitions
overlapping”.
Table 4.2
Support Software that used to configure and setup the test drives
Software Version Description agnostics tool for storage devices
MHDD 4.5 Low-level HDD Diagnostics Software
UltraEdit 16.10.0.1036 Hex Editor
Darik's Boot
2.2.6 Used to securely wipe the test drive
and Nuke
Hdparm
9.29
Linux Hard drive tool, used to check and change
parameter of the test hard drive
Gparted 0.6.2 Linux hard drive partitioning tool
Disk
Management
Tool
1.0.0
Windows hard disk partitioning tool
(Supports GUID partition table partition style)
Disk_stat 3.1.2 Used to check the existence of Host protected areas
EnCase 6.16.1 Used to verify the hash value of the acquired images
WinHex 15.6
Computer Forensics & Data Recovery Software,
Hex Editor & Disk Editor from X-Ways Software
A combination of tools was required to create and build up different testing
environments for the analysis and evaluation of the actual performance of the tools.
Test case TC-04 was not conducted due to the tool used to configure the test
environment not being available. Specially-developed programs would be required to
meet the requirements in order to conduct some specific test cases in this research.
HDAT2 is program for testing or diagnostics of various types of storage devices.
73