Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

provided space checking prior the disk imaging and notified that the user the
destination drive did not have enough space.
Table 4.8(2)
TC-08 Result Summary
Tested
Assertions
Failed
Assertions
Pass Rate
(%)
FTK Imager Helix 3 Pro AIR
AFR01-05, AFR07, AIC04-05, AIC10, ALOG01-03
None AIC-10, ALOG02
79
AIC04, AIC10
ALOG02
100% 83.33% 75%
AIR tool failed to achieve the expected result of this test. The imaging process of AIR
tool started the acquisition process for about and after a few seconds the process
stopped supposedly when it was discovered that the destination device did not have
enough storage space. No notification was issued to the user about insufficient space
in the destination and no record in the log file indicated why the program stopped.
4.2.2.7 TC-09: Verify A Correct Image
Test case TC-09 involved testing whether the image verification function provided by
the tool run correctly. This test case only applied to FTK Imager because it was
because the only imaging tool that supported the function. Table 4.9 shows the test
results of FTK Imager in test case TC-09.
Table 4.9
TC-09 Result Summary
FTK Imager
Tested Assertions AFR03, AIC06, ALOG01-03
Failed Assertions None
Pass Rate (%) 100%