Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Table 4.11
TC-11 Result Summary
Test Cases
Tested
Assertions
Failed
Assertions
Pass Rate
(%)
DD to
Smart
DD to
E01
E01 to
DD
81
FTK Imager
E01 to
SMART
AFR03, AFR09, ALOG01-03
None
100%
SMART to
E01
SMART
to DD
FTK Imager successfully converted from one image format to another in all six cases.
All verification hashes were matched the source hashes.
4.2.2.10 TC-12 (1&2): Acquiring Partition that is Partially Or Completely
Hidden
Test case TC-12 involved testing the responses of the disk imaging tools when they
encountered partitions that either were partially or completely hidden with the help of
HPA configuration. In the configuration of the test drive, partition FAT32 was setup
either partially or completely hidden through using HPA configuration. All three
tested tools attempted to acquire the hidden partition instead of the entire test drive.
All three evaluated tools failed to detect and acquire the hidden sectors that existed in
the test drive. Table 4.12 shows the test results of both test cases-TC-12(1) with
partially hidden partition and TC-12(2) with completely hidden partition.
Table 4.12
TC-12 Result Summary
Test Cases
FTK Imager Helix 3 Pro AIR
TC-12(1)
Partial
TC-12(2)
Complete
TC-12(1)
Partial
TC-12(2)
Complete
TC-12(1)
Partial
TC-12(2)
Complete
Tested
Assertions
AFR01-07, AIC01-02, AIC05-08, ALOG01-03, AHS01-03
Failed AFR06 EXCEPT AFR05-06 Failed AFR06, AHS01-03