Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

FTK Imager successfully verified the corrupt image file of FAT16 partition. The
verification hash values matched the source hash values.
4.2.2.8 TC-10: Verify A Corrupted Image
Test case TC-10 involved testing whether FTK Imager was capable to identify the
corrupted image. This test case only applied to FTK Imager because it was the only
imaging tool that supported the function. Hex editor was used in the test case to
change the data in the image file where the hex value of address 35df5f70h offset 8
was changed from value 43 to 42. Table 4.10 shows the test result of FTK Imager in
test case TC-10.
Table 4.10
TC-10 Result Summary
80
FTK Imager
Tested Assertions AFR03, AIC06-08, ALOG01-03
Failed Assertions AIC08
Pass Rate (%) 85.71%
FTK Imager successfully detected that the image files had been corrupted. The
verification hash values did not match the source hash values. However, the location
of the corrupted data was not reported to the user.
4.2.2.9 TC-11: Converting Existing Image Files To Another Image Format
Test case TC-11 involved testing whether the disk imaging tool could convert an
existing image file to another supported image file format. This test case only applied
to FTK Imager because it was the only imaging tool that supported the function. FTK
Imager supported three different image formats; therefore, six combinations of format
conversions were derived for testing.