Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Table 4.6
TC-05 Result Summary
Tested
Assertions
Failed
Assertions
Pass Rate
(%)
FTK Imager Helix 3 Pro AIR
AFR01-05, AFR07, AIC01-02, ALOG01-03
None ALOG01-02 None
100% 81.81% 100%
Table 4.6 provides a summary of the results of test case TC-05. During the testing of
Test case TC-05, FTK Imager and AIR were able to acquire the digital source
correctly in all supported alternative formats. Helix 3 Pro was able to acquire
successfully the data of the supported formats. However, the verification based on
comparison between the source and acquired data was not performed (see Section 2.12
in Appendix 7).
4.2.2.5 TC-06: Acquiring A Digital Source With Unresolved Read Error
Test case TC-06 tested whether the tested disk imaging tools would notify the user
about unresolved read error and would attempt to recover the data. Program MHDD
was utilised to mark the sectors as “bad sectors” so they could be remapped to spare
sectors on the drive. Fifteen sectors were marked with UNC error (refer to sections
1.16, 2.13 and 3.13 in Appendix 7 for more details). FTK Imager AIR have passed this
test and all the assertions were fulfilled. Table 4.7 has shown the summary of the test
case TC-06 results.
Alternative verification method was employed to verify whether the disk
imaging tools had replaced the inaccessible data sectors with value 0 as they were
described. Hex editor UltraEdit was used to check each pre-configured data sector that
had UNC error and to confirm whether the sector had been replaced with pre-
configured value. All three disk imaging tools had replaced the inaccessible data
sector with value 0.
77