Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

4.2.2.3 TC-03: Acquiring A Hard Drive With Hidden Sectors
Test case TC-03 involved testing if the tested disk imaging tools were able to acquire
the hidden sectors configured in the test drive. Certain amount of sectors in the test
drive was configured as hidden using HPA configuration.
Table 4.5 shows that all three disk imaging tools were failed to acquire the
HPA or DCO hidden area in the test drive. However, all the data that were accessible
were acquired correctly by all three tested tools. FTK Imager was crashed twice when
acquiring the DCO configured test drive (see Section 1.12 in Appendix 7).
Table 4.5
TC-03 Result Summary
FTK Imager Helix 3 Pro AIR
Test Cases HPA DCO HPA DCO HPA DCO
Tested
Assertions
Failed
Assertions
Pass Rate
(%)
AFR01-07, AIC01-02, AIC05-08, ALOG01-03, AHS01-03
AFR06, AHS01-03
AFR06, AHS01-03,
ALOG02
76
AFR06, AHS01-03
85% 75% 85%
The program was crashed when FTK Imager was attempting to create a list of
directories of the acquired data. The debugging information of the crash is provided by
FTK Imager.
4.2.2.4 TC-05: Acquiring A Digital Source In An Alternative Supported
Format
Test case TC-05 involved testing if the disk imaging tools were able to produce
complete and accurate image files in alternative supported format. Not all the tested
tools support more than one format. The image format dd is supported by all tools.
FTK Imager supports the most alternative image formats, which are dd, SMART and
Encase E01. AIR supports dd and dc3dd image formats and Helix 3 pro supports dd
and Encase E01 formats.