Create an account Home  ·  Topics  ·  Downloads  ·  Your Account  ·  Submit News  ·  Top 10  
Modules
· Home
· Content
· FAQ
· Forensic Downloads
· Forensics Feedback
· Forums
· Members List
· Statistics
· Surveys
· Top 10
· Topics
· Training Reviews
· Web Links
· Your Account

Our Membership

Latest: BradErz
New Today: 0
New Yesterday: 1
Overall: 29174

Computer Forensics
This is a free and open peer to peer medium for digital and computer forensics professionals and students. Please help us maintain it by contributing and perhaps linking to us from your own website.

Recent Posts

 Covert Aff to DD
 Ransomware Attack in Hospital
 Ransomware Attack in Hospital
 Deleting Files
 open all the unread emails at once in Outlook

Computer Forensics World Forums


Pages Served
We received
47227482
page views since August 2004

Security Sources

FTC
OnGuard Online
ISO 17799 ISO 27001
ISO 27000 Toolkit
ISO 27001 & 27000
Cryptography
Security Policies

Disk Imaging Tool Specification




An interesting paper from NIST, detailing their specification and requirements of disk imaging tools:




1. INTRODUCTION
Accurate and dependable computer forensics tools are required for a reliable means of investigating crimes that involve computers. In order to insure a measure of reliability and assurance that the results are accurate, the tools used in these investigations should be tested. The Computer Forensics Tool Verification project at the National Institute of Standards and Technology (NIST), an agency of the United States Department of Commerce, provides a measure of confidence in the software tools used in computer forensics investigations. It provides law enforcement personnel with a means of deciding whether the tools in consideration for use should be applied to the purposes required.

2. PURPOSE
This document defines requirements for disk imaging tools used in computer forensics investigations and the test methods used to ascertain whether a specific tool meets the requirements. 

The requirements are used to derive assertions that will be tested. The assertions are described as general statements of conditions that can be checked after a test is executed. Each assertion will have one or more test cases that specify detailed start parameters, procedures for executing a test, and expected results.



The requirements and test methods were developed by a focus group of individuals who are expert in the use of disk imaging tools and have performed investigations that have depended on the results of these tools. As this document evolves through comments from the focus group and others, new versions will be posted to our web site at http://www.cftt.nist.gov.

3. SCOPE
The scope of this specification is limited to software tools that copy or image hard disk drives. Not included are tools that image removable media, such as floppy disks or zip disks; analog media; and other digital media, such as cell phones or pagers. Definitions for hard disk drive related terms can be found in NCITS 347:2001 “American National Standard for Information Technology – BIOS Enhanced Disk Drive Services.” 



The proper use or misuse of a tool is not within the scope of this specification.



This specification can become the basis for other specifications to test tools that image digital media other than hard disk drives. 

4. GLOSSARY
This glossary was added to provide context in the absence of official definitions recognized by the computer forensics community.



4.1 Bit-stream duplicate: a bit-for-bit digital copy of a digital original document, file, partition, graphic image, entire disk, or similar object.

4.2 Checksum: a hash computed from a specific computational algorithm, such as the Cyclic Redundancy Checksum 32-bit (CRC-32).

4.3 Disk compares equal: a bit-stream duplicate is compared to the original digital object and no differences are found.

4.4 Disk compares qualified equal: a bit-stream duplicate is compared to the original digital object and the only differences found are those documented as different by the tool that created the bit-stream duplicate or image from which a bit-stream duplicate was reconstructed. (See “qualified bit-stream duplicate”.)

4.5 Duplicate: a copy of an original object.

4.6 Hash: A function that maps keys to integers, usually to provide an even distribution of keys on a smaller set of values. A coded number or string of characters used to represent the value derived from a hash function on the contents of a bit-string, in this case a disk, partition, image, or file contents.

4.7 Image: a digital, sometimes compressed, file from which a bit-stream duplicate of an original digital object can be reconstructed.

4.8 Qualified bit-stream duplicate: a duplicate except in identified areas of the bit-stream, such that the identified areas are replaced by values specified by a disk imaging tool’s documentation, such as partition table entries to reflect relocated partitions; boot records; fill areas required for cylinder alignment, and excess disk space.

5. REQUIREMENTS
The top-level disk imaging tool requirements are the following:



The tool shall make a bit-stream duplicate or an image of an original disk or partition. 
The tool shall not alter the original disk. 
The tool shall be able to verify the integrity of a disk image file. 
The tool shall log I/O errors. 
The tool’s documentation shall be correct. 


While these requirements appear to be clear and concise, they are rife with implicit requirements and ambiguities. An effort to be more precise is required in order to evaluate how well a particular implementation meets the requirements. Sections 5.1 and 5.2 contain more precise statements of these requirements.



All disk imaging tools shall be able to accomplish the tasks described as mandatory requirements. Optional requirements are tested as if they were mandatory requirements if the tool under test supports the applicable feature. If a specific tool does not provide the capabilities of a particular optional requirement, then the tool is not tested for that requirement. This means that a specific tool might provide none of the capabilities described under optional requirements.

5.1 Mandatory Requirements
The following requirements are mandatory and shall be met by all disk imaging tools.



5.1.1 The tool shall not alter the original.

5.1.2 If there are no errors accessing the source, then the tool shall create a bit-stream duplicate or image of the source.

5.1.3 If there are I/O errors accessing the source, then the tool shall create a qualified bit-stream duplicate or image of the source. (A qualified bit-stream duplicate is defined to be a duplicate except in identified areas of the bit-stream.) The identified areas are replaced by values specified by the tool’s documentation.

5.1.4 The tool shall log I/O errors in an accessible and readable form, including the type of error and location of the error.

5.1.5 The tool shall be able to access disk drives through one or more well-defined interfaces.

5.1.6 Documentation shall be correct insofar as the mandatory and any implemented optional requirements are concerned, i.e., if a user following the tool’s documented procedures produces the expected result, then the documentation is deemed correct.

5.1.7 If the tool copies a source to a destination that is larger than the source, and it shall document the contents of the areas on the destination that are not part of the copy.

5.1.8 If the tool copies a source to a destination that is smaller than the source, the tool shall notify the user, truncate the copy, and log this action.

5.2 Optional Requirements
The following requirements define optional tool features. If a tool provides the capability defined, the tool is tested as if the requirement were mandatory. If the tool does not provide the capability defined, the requirement does not apply.



5.2.1 The tool shall compute a hash value of the complete bit-stream duplicate generated from an image file of the original source, compare the computed hash value to the hash value of the original source computed at the time the image was created, and log the results of the comparison on a disk file.

5.2.2 The tool shall divide the destination bit-stream into blocks, compute a hash value for each block, compare the computed hash value to the hash value of the original block of source data computed at the time the image was created, and log the results of the comparison on a disk file.

5.2.3 The tool shall create a bit-stream duplicate of individual partitions as directed by the user.

5.2.4 The tool shall allow the user to view the source partition table and the tool shall log the contents of the source partition table.

5.2.5 The tool shall log one or more of the following items on a disk file: tool version, subject disk identification (if the identification is available, such as manufacturer, make, model, serial number, sector count, etc.), any errors encountered, tool actions, start and finish run times, tool settings, and user comments.

5.2.6 The tool shall create an image file on fixed or removable electronic or magnetic media that can be used to create a bit-stream duplicate of the original.

5.2.7 The tool shall create a qualified bit-stream duplicate and adjust the alignment of cylinders to cylinder boundaries of disk partitions on a destination of a different physical geometry. The identified areas of the duplicate that are allowed to be changed are the following: partition table entries to reflect the relocated partitions; boot records; fill areas required for cylinder alignment, and excess disk space. The fill areas shall be given values as specified in the tool documentation.

6. ASSERTIONS
Each assertion provides a specific class of conditions that can be tested and the result that is expected.

6.1 Mandatory Assertions
In the following, wherever source and destination are used without modification, the term refers to both source partitions and entire disks or destination partitions and entire disks. The requirement paragraph related to each assertion is referenced in parentheses.



6.1.1 If a source is accessed by the tool, then the source will not be altered. (5.1.1)

6.1.2 If there are no errors reading from a source, nor errors writing to a destination, then a bit-stream duplicate of the source will be created on the destination. (5.1.2)

6.1.3 If there are errors reading from a source or writing to a destination, then a qualified bit-stream duplicate of the source will be created on the destination. The identified areas are replaced by values specified by the tool’s documentation. (5.1.3)

6.1.4 If there are errors reading from the source or writing to the destination, then the error types and locations are logged. (5.1.4)

6.1.5 If the source or destination is an IDE or SCSI drive and an image or bit-stream duplicate is created, then the interface used is presumed to be among those specified in 5.1.5.

6.1.6 If the expected result of any test defined in this specification is achieved and the documentation was followed without change in achieving this result, then the documentation is presumed correct. (5.1.6)

6.1.7 If a bit-stream duplicate of a source is created on a larger destination, then the contents of areas on the destination that are not part of the duplicate are set to values as specified in the tool documentation. (5.1.7)

6.1.8 If a bit-stream duplicate of a source is created on a smaller destination, then the duplicate is qualified by omitted portions of the bit-stream and the tool will notify the user that the source is larger than the destination. (5.1.8)

6.2 Optional Assertions
If an implementation provides a capability covered by one or more of the following optional assertions, then tests derived from those assertions will be applied to the implementation.



6.2.1 If a hash of one or more blocks (i.e., less than the entire disk) from the source is computed before duplication and is compared to a hash of the same blocks from the destination, the hashes will compare equal. (5.2.1, 5.2.2)

6.2.2 If more than one partition exists on the source disk, the tool will produce a duplicate of any user-selected source partition on the destination. (5.2.3)

6.2.3 If a partition exists on the source, the tool will display or log a message indicating that the partition exists and display or log one or more items of information from the following list: drive indicator, device type, device address or mount point, size, space used, and free space. (5.2.4)

6.2.4 If the tool logs the tool version, it will be the version referred to in the implementation’s documentation. (5.2.5)

6.2.5 If the subject disk identification is available and the tool is capable of logging the subject disk identification, then the subject disk identification will be logged. (5.2.5)

6.2.6 If the tool logs the source partition table in human readable form and the information from the source partition table can be ascertained independently from the tool, then the source partition table information will accurately match the content of the independent partition table information. (5.2.5)

6.2.7 If the tool logs errors and any error occurs, then the type and location of the error will be logged. (5.2.5)

6.2.8 If the tool logs tool actions and the tool’s documentation states what actions are logged, then the actions logged will accurately match those documented in the tool’s documentation. (5.2.5)

6.2.9 If the tool logs start and finish run times, then the logged start and finish run times will accurately match those recorded by the tester according to screen input images, test input scripts, or tester notes. (5.2.5)

6.2.10 If the tool logs tool settings and the tool’s documentation states what settings are logged, then the logged settings will accurately match those set by the tester or as documented in the tool’s documentation. (5.2.5)

6.2.11 If the tool logs user comments, then the logged user comments will accurately match those entered by the tester as captured in screen input images, test input scripts, or tester notes. (5.2.5)

6.2.12 If the tool creates image files, then it will create an image file of a source on a magnetic medium that can be removed from the platform on which it was created. (5.2.6)

6.2.13 If the tool creates an image file from a source on a removable magnetic medium, then a duplicate of the source created from the removable magnetic medium will result in a duplicate on the destination and the destination will compare equal to the source. (5.2.6)

6.2.14 If an image file is created, and there are no errors reading from a source, nor errors writing to a destination, then a bit-stream duplicate created from the image file will compare equal to the source. (5.2.6)

7. ABSTRACT TEST CASES
Abstract test cases describe the combinations of tests required to fully test each assertion. They are abstract in that they do not prescribe the exact environment in which the tests are to be performed. They are written at the next level above the environment. This allows different environments to be substituted under the test cases for testing different products and options.



A set of test parameters are chosen to cover the assertions from various aspects, such as relative disk sizes, firmware configurations, existence of I/O errors, etc. Not all possible tests will be specified since this number could run into the hundreds or thousands based on the combinations of parameters that could be used. Exhaustive testing, in most cases, is not economically feasible. Instead, a subset of parameters will be used to define the set of test cases needed to evaluate tools against the requirements.

7.1 Test Parameters
The following defines the test parameters that are used in this set of abstract test cases.



7.1.1 Tool action – create a copy or image, or verify an image

7.1.2 Firmware interface – IDE/Interrupt 13h BIOS, IDE/Interrupt 13h BIOS Extended, SCSI/Interrupt 13h BIOS Extended, IDE/Direct access, SCSI/ASPI Driver, IDE/Linux, SCSI/Linux, Linux with IDE source and SCSI destination, Linux with SCSI source and IDE destination, Interrupt 13h Extended with IDE source and SCSI destination, and Interrupt 13h Extended with SCSI source and IDE destination

7.1.3 Subject entity – entire disk or partition

7.1.4 Relative disk sizes – source larger than destination, source equal to destination, source less than destination with unused area filled and cylinder adjustment, source less than destination with unused area not filled and no cylinder adjustment, source less than destination with unused area filled and no cylinder adjustment, and source less than destination with unused area not filled and cylinder adjustment

7.1.5 Destination media – fixed disk, removable media

7.1.6 I/O errors – source read error, destination write error, image read error, image write error, no error



These parameters can be combined into numerous combinations to present a formidable set of test cases for any tool. Judicious trimming of these parameters is used to reduce the number of test cases that are actually needed to provide a significant amount of coverage based on cost, time, and other constraints. Ultimately, sufficient testing will be performed to demonstrate that the mandatory requirements are met and that the optional requirements have been exercised at least once.



Guidance for trimming the number of test cases was sought from the computer forensics arena through informal information gathering. A summary of this information provides the context for the constraints used in trimming the parameter values and combinations needed. (Percentages do not add up to 100% due to overlapping characteristics of the information provided.)



· 69% of users use disk images rather than disk copies and 20% use partition images.

· 48% of copies and images are made in the field and 36% are made in laboratories.

· 57% of the drives imaged are larger than 8.4GB and 35% are less than that size.

· 50% of the drives imaged require IDE BIOS/Extended BIOS access and 63% require direct (ASPI) SCSI access.

· 25 to 33% of users sometimes mix IDE and SCSI drives in making images or copies, 25% often do so, and 13% always do.



The constraints for this trimming based on the above guidance are listed in the following.



1. Action – Documentation and logging will be tested in every case. Verification of images will be included in specific test cases. The source will be checked in every case to determine if the tool has modified it.

2. Firmware interface – IDE access through BIOS and Extended BIOS will form the major part of these tests. SCSI and Linux will augment these cases using BIOS and ASPI access. Some cases will test direct access.

3. Subject entity – Entire disks will be tested in the large majority of cases. Partitions will be used in those cases where non-direct-access interfaces are called for.

4. Relative disk size – Source less than destination will be included for most test cases. These will be augmented with limited tests for source equal to and source greater than destination where an entire disk is involved.

5. Destination media – Most tests will be performed with fixed media. Limited tests will be performed with removable media where partition copies and partition images are involved.

6. I/O errors – Limited tests for I/O errors on source reads and destination writes will be included where entire disks are involved and non-direct interfaces are required. Additional tests will be added for image read and write errors.

7.2 Test Procedures
7.2.1 Test setup
The tests will be executed using the following procedures. Much of the information reported will be generated automatically by scripts used in performing tests. Some information must be reported by the specific person performing the tests.



1. The date, time and person doing the testing will be written on the lab form.

2. The test case number and summary information will be identified on the form.

3. The hardware selected for testing will be identified and documented on the testing lab form. Identification will include the cpu(s). All hard disks should be removed and the computer should be turned off.

4. The version and release date of the testing software used will be identified and documented on the testing lab form.

7.2.2 Disk setup
1. Based on the summary of the test case, the tester will identify whether two or three disks are required and the size disks required. The disks selected for the test case will be identified and documented on the lab form.

2. The system is booted from a DOS boot floppy

3. DISKWIPE will be run on the source, destination, and if appropriate imaging disk – making certain that the log files created by the DISKWIPE program are captured on a floppy disk and that the fill byte is documented on the testing lab form.

4. If a partition is required for the test case, FDISK or other software to establish the kind of partition specified in the test case will be run and FORMAT will be run to format the partition. The size and type of partition(s) will be documented on the testing lab form.

5. If an error is required for the test case the program to generate the error will be run and the variables used documented on the lab form.

6. The diskhash program will be run on the contents of the source making certain that the log file results are captured on a floppy disk.

7.2.3 Test execution
The tests will run in a controlled environment, i.e., specified test machines setup for this function. Dates and times will be documented on the lab form for all steps. All log files will be captured on a floppy disk, copied onto a hard disk and sent to the program manager. When the tests have been completed for a test case, a hash is generated for the source disk and the results stored in a log file. This hash code is compared with the one generated after the source disk setup to assure that the source disk was not altered.



Supporting software was developed to assist in the execution of tests. The programs include the following:



· ADJCMP – Compares the contents of the source disk with the destination disk in cases where partitions and unallocated storage exist.

· BADDISK – A terminate-and-stay-resident (TSR) program used to intercept read and write interrupts for the introduction of read and write errors in tests where error logging is checked.

· CORRUPT – Modifies an image file to check for image verification capabilities.

· DISKCMP – Performs a sector-by-sector comparison between the same sector addresses of the source disk and the destination disk.

· DISKHASH – Computes a SHA-1 hash value of an entire disk.

· DISKWIPE – Writes a hexadecimal bit pattern to each byte on a source or destination disk to initialize the disk with known values.

· PARTAB – Displays and logs the contents of the source and destination partition tables.

· PARTCMP – Performs a sector-by-sector comparison between partitions on the source and destination disks.



Further information about this software and how the tests are structured to use these tools is available in the user manual associated with the software.

7.2.4 Test results
The test results will be analyzed and summarized by the tester and attached to the test lab form. The paper form, log files, and electronic test results form, including the summary and analysis will be sent to the program manager via email.

7.2.5 Laboratory form
The following is an example of a completed test laboratory form.



Test Results for SomeVendorsTool Product



Tester: Melvin Tester 

Date started: 06/07/2001


Test Case ID: DI-33

Test Case Summary: copy XBIOS-IDE disk PT-N/A SRC=DST/NN fixed errors

Testing Environment:

PC beta 5

Disks B0 Fujitsu MPF3153AT 8.455 MB as master and B1 Fujitsu MPF3153AT 8.455 MB as slave

Interface XBIOS-IDE

File type NTFS

Test Software Used: DISKWIPE 2.3 BADX13 2.1 DISKCMP 2.2 DISKHASH 1.1

Setup: booted from DOS boot floppy

typed diskwipe /xbios

Inserted log floppy after each run to capture log files

At prompt typed ‘beta 5 XX-08 disk copy with read error on large > 8.4 disks’ 

Answered ‘y’ to wipe master with fill byte B0

Anwered ‘y’ to wipeout started at 10:50 am ended at 11:15am

Rebooted from DOS 

Execute: To insert error removed DOS floppy and inserted log floppy

Typed BADX13 81 42 10 1000000 > BD-RD-D8.txt to run error program

Removed log disk, inserted Master disk – typed ‘Master’ – inserted log disk

At prompt typed ‘XX-08.txt’

Chose entries from screen for copy, local, no, auto, auto, yes, yes and hit enter

Chose source as 1 and dst as 0

Typed PT-XX-08 and hit enter causing product to run

Rebooted from DOS 

Typed diskcmp B1 B0 /xbios 

At prompt typed ‘beta 5 XX-08 src read 1,000,000’

When finished removed log disk



Log Files id & loc: created folder on office machine labeled XX-08 and moved log files from log disk into new folder - combined log files to filename XX-08.txt

Expected Results: Log file should contain an error message 

Source and destination should compare qualified equal

Results: A src read error was identified at 1,000,000 – other sectors compared equal

Log File Highlight Elements:



Return error code 10 for X13 command 42 from drive 81 at LBA sector 1,000,000



Sectors compared: 30023280

Sectors match: 30023279

Sectors differ: 1

Bytes differ: 492

Diffs range: 1000000



Analysis: Expected results were obtained



Email, log files, and form file names and sent date: XX-08.txt, XX-08.doc sent 06/07/2001



Much of this information can be generated automatically by the test scripts used to run the tests. In order to assure quality and uniformity of test reports, an automated process is suggested for collecting the appropriate information.

7.3 Test Cases
A description of each test case is given below.



Non-Linux Test Cases 


TEST CASE: DI-1

Copy a BIOS IDE source disk

to a BIOS IDE destination disk

where the source disk is smaller than the destination

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-2

Copy a BIOS IDE source disk

to a BIOS IDE destination disk

where the source disk is smaller than the destination

and sector fill is turned on

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-3

Copy a BIOS IDE source disk

to a BIOS IDE destination disk

where the source disk is smaller than the destination

and cylinder adjustment is turned on

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-4

Copy a BIOS IDE source disk

to a BIOS IDE destination disk

where the source disk is smaller than the destination

and sector fill is turned on

and cylinder adjustment is turned on

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-5

Copy a BIOS IDE source disk

to a BIOS IDE destination disk

where the source disk is the same size as the destination

Introduce a read error from the source.

EXPECTED RESULTS:

src compares qualified equal to dst

error message logged



TEST CASE: DI-6

Copy a BIOS IDE source disk

to a BIOS IDE destination disk

where the source disk is the same size as the destination

Introduce a write error to the destination.

EXPECTED RESULTS:

src compares qualified equal to dst

error message logged



TEST CASE: DI-7

Copy a BIOS IDE source disk

to a BIOS IDE destination disk

where the source disk is the same size as the destination

EXPECTED RESULTS:

src compares equal to dst



TEST CASE: DI-8

Copy a BIOS IDE source disk

to a BIOS IDE destination disk

where the source disk is larger than the destination

EXPECTED RESULTS:

src compares qualified equal to dst, src is truncated on dst

truncation is logged



TEST CASE: DI-9

Copy a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a FAT12 partition

where the source disk is smaller than the destination

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-10

Copy a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a FAT16 partition

where the source disk is smaller than the destination

and sector fill is turned on

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-11

Copy a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a FAT32 partition

where the source disk is smaller than the destination

and cylinder adjustment is turned on

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-12

Copy a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a NTFS partition

where the source disk is smaller than the destination

and sector fill is turned on

and cylinder adjustment is turned on

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-13

Copy a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a LINUX partition

where the source disk is smaller than the destination

and source contains a deleted file and a hidden file

After the duplicate is created on the destination, unhide the hidden

file and undelete the deleted file.

EXPECTED RESULTS:

src compares qualified equal to dst

hidden and deleted files recovered



TEST CASE: DI-14

Copy a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a FAT16 partition

where the source disk is the same size as the destination

Introduce a read error from the source.

EXPECTED RESULTS:

src compares qualified equal to dst

error message logged



TEST CASE: DI-15

Copy a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a FAT32 partition

where the source disk is the same size as the destination

Introduce a write error to the destination.

EXPECTED RESULTS:

src compares qualified equal to dst

error message logged



TEST CASE: DI-16

Copy a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a FAT16 partition

where the source disk is the same size as the destination

EXPECTED RESULTS:

src compares equal to dst



TEST CASE: DI-17

Copy a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a FAT32 partition

where the source disk is larger than the destination

EXPECTED RESULTS:

src compares qualified equal to dst, src is truncated on dst

truncation is logged



TEST CASE: DI-18

Copy an XBIOS IDE source disk

to an XBIOS IDE destination disk

where the source disk is smaller than the destination

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-19

Copy an XBIOS IDE source disk

to an XBIOS IDE destination disk

where the source disk is smaller than the destination

and sector fill is turned on

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-20

Copy an XBIOS IDE source disk

to an XBIOS IDE destination disk

where the source disk is the same size as the destination

Introduce a read error from the source.

EXPECTED RESULTS:

src compares qualified equal to dst

error message logged



TEST CASE: DI-21

Copy an XBIOS IDE source disk

to an XBIOS IDE destination disk

where the source disk is the same size as the destination

Introduce a write error to the destination.

EXPECTED RESULTS:

src compares qualified equal to dst

error message logged



TEST CASE: DI-22

Copy an XBIOS IDE source disk

to an XBIOS IDE destination disk

where the source disk is the same size as the destination

EXPECTED RESULTS:

src compares equal to dst



TEST CASE: DI-23

Copy an XBIOS IDE source disk

to an XBIOS IDE destination disk

where the source disk is larger than the destination

EXPECTED RESULTS:

src compares qualified equal to dst, src is truncated on dst

truncation is logged



TEST CASE: DI-24

Copy an XBIOS IDE source disk

to an XBIOS IDE destination disk

and the source contains a FAT16 partition

where the source disk is smaller than the destination

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-25

Copy an XBIOS IDE source disk

to an XBIOS IDE destination disk

and the source contains a FAT32 partition

where the source disk is smaller than the destination

and sector fill is turned on

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-26

Copy an XBIOS IDE source disk

to an XBIOS IDE destination disk

and the source contains a NTFS partition

where the source disk is smaller than the destination

and source contains a deleted file and a hidden file

After the duplicate is created on the destination, unhide the hidden

file and undelete the deleted file.

EXPECTED RESULTS:

src compares qualified equal to dst

hidden and deleted files recovered



TEST CASE: DI-27

Copy an XBIOS IDE source disk

to an XBIOS IDE destination disk

and the source contains a FAT32 partition

where the source disk is the same size as the destination

Introduce a read error from the source.

EXPECTED RESULTS:

src compares qualified equal to dst

error message logged



TEST CASE: DI-28

Copy an XBIOS IDE source disk

to an XBIOS IDE destination disk

and the source contains a NTFS partition

where the source disk is the same size as the destination

Introduce a write error to the destination.

EXPECTED RESULTS:

src compares qualified equal to dst

error message logged



TEST CASE: DI-29

Copy an XBIOS IDE source disk

to an XBIOS IDE destination disk

and the source contains a LINUX partition

where the source disk is the same size as the destination

EXPECTED RESULTS:

src compares equal to dst



TEST CASE: DI-30

Copy an XBIOS IDE source disk

to an XBIOS IDE destination disk

and the source contains a FAT32 partition

where the source disk is larger than the destination

EXPECTED RESULTS:

src compares qualified equal to dst, src is truncated on dst

truncation is logged



TEST CASE: DI-31

Copy an XBIOS-SCSI source disk

to an XBIOS SCSI destination disk

where the source disk is smaller than the destination

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-32

Copy an XBIOS-SCSI source disk

to an XBIOS SCSI destination disk

where the source disk is smaller than the destination

and sector fill is turned on

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-33

Copy an XBIOS-SCSI source disk

to an XBIOS SCSI destination disk

where the source disk is the same size as the destination

Introduce a read error from the source.

EXPECTED RESULTS:

src compares qualified equal to dst

error message logged



TEST CASE: DI-34

Copy an XBIOS-SCSI source disk

to an XBIOS SCSI destination disk

where the source disk is the same size as the destination

Introduce a write error to the destination.

EXPECTED RESULTS:

src compares qualified equal to dst

error message logged



TEST CASE: DI-35

Copy an XBIOS-SCSI source disk

to an XBIOS SCSI destination disk

where the source disk is the same size as the destination

EXPECTED RESULTS:

src compares equal to dst



TEST CASE: DI-36

Copy an XBIOS-SCSI source disk

to an XBIOS SCSI destination disk

where the source disk is larger than the destination

EXPECTED RESULTS:

src compares qualified equal to dst, src is truncated on dst

truncation is logged



TEST CASE: DI-37

Copy an XBIOS-SCSI source disk

to an XBIOS SCSI destination disk

and the source contains a LINUX partition

where the source disk is smaller than the destination

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-38

Copy an XBIOS-SCSI source disk

to an XBIOS SCSI destination disk

and the source contains a NTFS partition

where the source disk is smaller than the destination

and sector fill is turned on

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-39

Copy an XBIOS-SCSI source disk

to an XBIOS SCSI destination disk

and the source contains a FAT32 partition

where the source disk is smaller than the destination

and source contains a deleted file and a hidden file

After the duplicate is created on the destination, unhide the hidden

file and undelete the deleted file.

EXPECTED RESULTS:

src compares qualified equal to dst

hidden and deleted files recovered



TEST CASE: DI-40

Copy an XBIOS-SCSI source disk

to an XBIOS SCSI destination disk

and the source contains a FAT16 partition

where the source disk is the same size as the destination

Introduce a read error from the source.

EXPECTED RESULTS:

src compares qualified equal to dst

error message logged



TEST CASE: DI-41

Copy an XBIOS-SCSI source disk

to an XBIOS SCSI destination disk

and the source contains a FAT32 partition

where the source disk is the same size as the destination

Introduce a write error to the destination.

EXPECTED RESULTS:

src compares qualified equal to dst

error message logged



TEST CASE: DI-42

Copy an XBIOS-SCSI source disk

to an XBIOS SCSI destination disk

and the source contains a NTFS partition

where the source disk is the same size as the destination

EXPECTED RESULTS:

src compares equal to dst



TEST CASE: DI-43

Copy an XBIOS-SCSI source disk

to an XBIOS SCSI destination disk

and the source contains a LINUX partition

where the source disk is larger than the destination

EXPECTED RESULTS:

src compares qualified equal to dst, src is truncated on dst

truncation is logged



TEST CASE: DI-44

Copy a direct access IDE source disk

to a direct access IDE destination disk

where the source disk is smaller than the destination

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-45

Copy a direct access IDE source disk

to a direct access IDE destination disk

where the source disk is smaller than the destination

and sector fill is turned on

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-46

Copy a direct access IDE source disk

to a direct access IDE destination disk

where the source disk is smaller than the destination

and cylinder adjustment is turned on

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-47

Copy a direct access IDE source disk

to a direct access IDE destination disk

where the source disk is smaller than the destination

and sector fill is turned on

and cylinder adjustment is turned on

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-48

Copy a direct access IDE source disk

to a direct access IDE destination disk

where the source disk is the same size as the destination

EXPECTED RESULTS:

src compares equal to dst



TEST CASE: DI-49

Copy a direct access IDE source disk

to a direct access IDE destination disk

where the source disk is larger than the destination

EXPECTED RESULTS:

src compares qualified equal to dst, src is truncated on dst

truncation is logged



TEST CASE: DI-50

Copy an ASPI SCSI source disk

to an ASPI SCSI destination disk

where the source disk is smaller than the destination

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-51

Copy an ASPI SCSI source disk

to an ASPI SCSI destination disk

where the source disk is smaller than the destination

and sector fill is turned on

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-52

Copy an ASPI SCSI source disk

to an ASPI SCSI destination disk

where the source disk is smaller than the destination

and cylinder adjustment is turned on

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-53

Copy an ASPI SCSI source disk

to an ASPI SCSI destination disk

where the source disk is smaller than the destination

and sector fill is turned on

and cylinder adjustment is turned on

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-54

Copy an ASPI SCSI source disk

to an ASPI SCSI destination disk

where the source disk is the same size as the destination

EXPECTED RESULTS:

src compares equal to dst



TEST CASE: DI-55

Copy an ASPI SCSI source disk

to an ASPI SCSI destination disk

where the source disk is larger than the destination

EXPECTED RESULTS:

src compares qualified equal to dst, src is truncated on dst

truncation is logged



TEST CASE: DI-56

Copy an XBIOS-IDE source disk

to an XBIOS SCSI destination disk

where the source disk is smaller than the destination

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-57

Copy an XBIOS-IDE source disk

to an XBIOS SCSI destination disk

where the source disk is smaller than the destination

and sector fill is turned on

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-58

Copy an XBIOS-IDE source disk

to an XBIOS SCSI destination disk

where the source disk is larger than the destination

EXPECTED RESULTS:

src compares qualified equal to dst, src is truncated on dst

truncation is logged



TEST CASE: DI-59

Copy an XBIOS SCSI source disk

to an XBIOS IDE destination disk

where the source disk is smaller than the destination

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-60

Copy an XBIOS SCSI source disk

to an XBIOS IDE destination disk

where the source disk is smaller than the destination

and sector fill is turned on

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-61

Copy an XBIOS SCSI source disk

to an XBIOS IDE destination disk

where the source disk is larger than the destination

EXPECTED RESULTS:

src compares qualified equal to dst, src is truncated on dst

truncation is logged



TEST CASE: DI-62

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

where the source disk is smaller than the destination

Introduce an error on the image.

EXPECTED RESULTS:

image verification error



TEST CASE: DI-63

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

where the source disk is smaller than the destination

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-64

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

where the source disk is the same size as the destination

Introduce a read error from the source.

EXPECTED RESULTS:

src compares qualified equal to dst

error message logged



TEST CASE: DI-65

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

where the source disk is the same size as the destination

Introduce a write error to the destination.

EXPECTED RESULTS:

src compares qualified equal to dst

error message logged



TEST CASE: DI-66

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

where the source disk is the same size as the destination

Introduce a read error reading from the image.

EXPECTED RESULTS:

error message logged



TEST CASE: DI-67

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

where the source disk is the same size as the destination

Introduce a write error writing to the image.

EXPECTED RESULTS:

error message logged



TEST CASE: DI-68

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

where the source disk is the same size as the destination

Introduce an error on the image.

EXPECTED RESULTS:

image verification error



TEST CASE: DI-69

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

where the source disk is the same size as the destination

EXPECTED RESULTS:

src compares equal to dst



TEST CASE: DI-70

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

where the source disk is larger than the destination

EXPECTED RESULTS:

src compares qualified equal to dst, src is truncated on dst

truncation is logged



TEST CASE: DI-71

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a FAT16 partition

where the source disk is smaller than the destination

Introduce an error on the image.

EXPECTED RESULTS:

image verification error



TEST CASE: DI-72

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a FAT32 partition

where the source disk is smaller than the destination

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-73

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a NTFS partition

where the source disk is smaller than the destination

Create the image on a removable medium.

Introduce an error on the image.

EXPECTED RESULTS:

image verification error



TEST CASE: DI-74

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a LINUX partition

where the source disk is smaller than the destination

Create the image on a removable medium.

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-75

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a FAT32 partition

where the source disk is smaller than the destination

and source contains a deleted file and a hidden file

Introduce an error on the image.

After the duplicate is created on the destination, unhide the hidden

file and undelete the deleted file.

EXPECTED RESULTS:

image verification error



TEST CASE: DI-76

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a FAT16 partition

where the source disk is smaller than the destination

and source contains a deleted file and a hidden file

After the duplicate is created on the destination, unhide the hidden

file and undelete the deleted file.

EXPECTED RESULTS:

src compares qualified equal to dst

hidden and deleted files recovered



TEST CASE: DI-77

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a NTFS partition

where the source disk is smaller than the destination

and source contains a deleted file and a hidden file

Create the image on a removable medium.

Introduce an error on the image.

After the duplicate is created on the destination, unhide the hidden

file and undelete the deleted file.

EXPECTED RESULTS:

image verification error



TEST CASE: DI-78

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a LINUX partition

where the source disk is smaller than the destination

and source contains a deleted file and a hidden file

Create the image on a removable medium.

After the duplicate is created on the destination, unhide the hidden

file and undelete the deleted file.

EXPECTED RESULTS:

src compares qualified equal to dst

hidden and deleted files recovered



TEST CASE: DI-79

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a LINUX partition

where the source disk is the same size as the destination

Introduce a read error from the source.

EXPECTED RESULTS:

src compares qualified equal to dst

error message logged



TEST CASE: DI-80

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a NTFS partition

where the source disk is the same size as the destination

Introduce a write error to the destination.

EXPECTED RESULTS:

src compares qualified equal to dst

error message logged



TEST CASE: DI-81

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a FAT32 partition

where the source disk is the same size as the destination

Introduce a read error reading from the image.

EXPECTED RESULTS:

error message logged



TEST CASE: DI-82

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a FAT16 partition

where the source disk is the same size as the destination

Introduce a write error writing to the image.

EXPECTED RESULTS:

error message logged



TEST CASE: DI-83

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a FAT32 partition

where the source disk is the same size as the destination

Introduce an error on the image.

EXPECTED RESULTS:

image verification error



TEST CASE: DI-84

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a NTFS partition

where the source disk is the same size as the destination

EXPECTED RESULTS:

src compares equal to dst



TEST CASE: DI-85

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a LINUX partition

where the source disk is the same size as the destination

Create the image on a removable medium.

Introduce a read error reading from the image.

EXPECTED RESULTS:

error message logged



TEST CASE: DI-86

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a FAT16 partition

where the source disk is the same size as the destination

Create the image on a removable medium.

Introduce a write error writing to the image.

EXPECTED RESULTS:

error message logged



TEST CASE: DI-87

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a NTFS partition

where the source disk is the same size as the destination

Create the image on a removable medium.

Introduce an error on the image.

EXPECTED RESULTS:

image verification error



TEST CASE: DI-88

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a LINUX partition

where the source disk is the same size as the destination

Create the image on a removable medium.

EXPECTED RESULTS:

src compares equal to dst



TEST CASE: DI-89

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a FAT32 partition

where the source disk is larger than the destination

EXPECTED RESULTS:

src compares qualified equal to dst, src is truncated on dst

truncation is logged



TEST CASE: DI-90

Create an image from a BIOS IDE source disk

to a BIOS IDE destination disk

and the source contains a FAT16 partition

where the source disk is larger than the destination

Create the image on a removable medium.

EXPECTED RESULTS:

src compares qualified equal to dst, src is truncated on dst

truncation is logged



TEST CASE: DI-91

Create an image from an XBIOS IDE source disk

to an XBIOS IDE destination disk

where the source disk is smaller than the destination

Introduce an error on the image.

EXPECTED RESULTS:

image verification error



TEST CASE: DI-92

Create an image from an XBIOS IDE source disk

to an XBIOS IDE destination disk

where the source disk is smaller than the destination

EXPECTED RESULTS:

src compares qualified equal to dst



TEST CASE: DI-93

Create an image from an XBIOS IDE source disk

to an XBIOS IDE destination disk

where the source disk is the same size as the destination

Introduce a read error from the source.

EXPECTED RESULTS:

src compares qualified equal to dst

error message logged



TEST CASE: DI-94

Create an image from an XBIOS IDE source disk

to an XBIOS IDE destination disk

where the source disk is the same size as the destination

Introduce a write error to the destination.

EXPECTED RESULTS:

src compares qualified equal to dst

error message logged



TEST CASE: DI-95

Create an image from an XBIOS IDE source disk

to an XBIOS IDE destination disk

where the source disk is the same size as the destination

Introduce a read error reading from the image.

EXPECTED RESULTS:

error message logged



TEST CASE: DI-96

Create an image from an XBIOS IDE source disk

to an XBIOS IDE destination disk

where the source disk is the same size as the destination

Introduce a write error writing to the image.

EXPECTED RESULTS:

error message logged



TEST CASE: DI-97

Create an image from an XBIOS IDE source disk

to an XBIOS IDE destination disk

where the source disk is the same size as the destination

Introduce an error on the image.

EXPECTED RESULTS:

image verification error



TEST CASE: DI-98

Create an image from an XBIOS IDE source disk

to an XBIOS IDE destination disk

where the source disk is the same size as the destination

EXPECTED RESULTS:

src compares equal to dst



TEST CASE: DI-99

Create an image from an XBIOS IDE source disk

to an XBIOS IDE destination disk

where the source disk is larger than the destination

EXPECTED RESULTS:

src compares qualified equal to dst, src is truncated on dst

truncation is logged



TEST CASE: DI-100

Create an image from an XBIOS IDE source disk

to an XBIOS IDE destination disk

and the source contains a FAT16 partition

where the source









Copyright © by Computer Forensics World All Right Reserved.

Published on: 2004-08-29 (20800 reads)

[ Go Back ]
Content ©

 

TMs property of their respective owner. Comments property of posters. © 2007 Computer Forensics Science World.
Digital forensic computing news syndication: Computer Forensics Training News or UM Text
Software is copyrighted phpnuke.org (c)2003, and is free under licence agreement. All Rights Are Reserved.