U.S. Department of Justice

Office of Justice Programs

National Institute of Justice

Special REPORT

Test Results for Digital Data Acquisition Tool:

EnCase 5.05f

AUG. 08

Office of Justice Programs

Innovation • Partnerships • Safer Neighborhoods

www.ojp.usdoj.gov

www.ojp.usdoj.gov/nij
U.S. Department of Justice

Office of Justice Programs

810 Seventh Street N.W.

Washington, DC 20531

Michael B. Mukasey

Attorney General

Jeffrey L. Sedgwick 

Acting Assistant Attorney General 

David W. Hagy

Director, National Institute of Justice

This and other publications and products of the National Institute

of Justice can be found at:

National Institute of Justice

www.ojp.usdoj.gov/nij

Office of Justice Programs

Innovation • Partnerships • Safer Neighborhoods

www.ojp.usdoj.gov
Test Results for Digital Data Acquisition Tool:

EnCase 5.05f

AUG. 08

NCJ 223433
This report was prepared for the National Institute of Justice, U.S. Department of Justice, by the

Office of Law Enforcement Standards of the National Institute of Standards and Technology

under Interagency Agreement 2003–IJ–R–029. 

The National Institute of Justice is a component of the Office of Justice Programs, which also

includes the Bureau of Justice Assistance, the Bureau of Justice Statistics, the Office of

Juvenile Justice and Delinquency Prevention, and the Office for Victims of Crime. 

David W. Hagy

Director, National Institute of Justice
June 2008 

Test Results for Digital Data Acquisition Tool: 

EnCase 5.05f
 

August 2008 ii Test Results for EnCase 5.05f June 2008
 

August 2008 iii Test Results for EnCase 5.05f June 2008

Contents 

1 Results Summary ...................................................................................................................... 2 

2 Test Case Selection ................................................................................................................... 2 

3 Results by Test Assertion.......................................................................................................... 4 

3.1 Logical Acquisition of NTFS Data Duplication ................................................................ 6 

3.2 Logical Acquisition of NTFS Last Sector Omitted ........................................................... 6 

3.3 Acquisition of Faulty Sectors............................................................................................. 6 

3.4 Alternate Restore Procedure .............................................................................................. 6 

4 Testing Environment ................................................................................................................. 7 

4.1 Test Computers .................................................................................................................. 7 

4.2 Support Software ............................................................................................................... 7 

5 Test Results ............................................................................................................................... 7 

5.1 Test Results Report Key .................................................................................................... 8 

5.2 Test Details ........................................................................................................................ 8 

5.2.1 DA-06-ATA28 ............................................................................................................ 8 

5.2.2 DA-06-ATA48 .......................................................................................................... 11

5.2.3 DA-06-FLOPPY ....................................................................................................... 13 

5.2.4 DA-06-FW ................................................................................................................ 14 

5.2.5 DA-06-NCAB-ENBD ............................................................................................... 16 

5.2.6 DA-06-NCAB-LINEN .............................................................................................. 18 

5.2.7 DA-06-PART ............................................................................................................ 20 

5.2.8 DA-06-SCSI .............................................................................................................. 21 

5.2.9 DA-06-USB .............................................................................................................. 23 

5.2.10 DA-07-CF ............................................................................................................... 25 

5.2.11 DA-07-F12 .............................................................................................................. 27 

5.2.12 DA-07-F16 .............................................................................................................. 29 

5.2.13 DA-07-F32 .............................................................................................................. 31 

5.2.14 DA-07-F32X ........................................................................................................... 33 

5.2.15 DA-07-NTFS .......................................................................................................... 35

5.2.16 DA-07-THUMB ...................................................................................................... 37 

5.2.17 DA-08-ATA28 ........................................................................................................ 39 

5.2.18 DA-08-ATA48 ........................................................................................................ 41 

5.2.19 DA-08-DCO ............................................................................................................ 43 

5.2.20 DA-09-01 ................................................................................................................ 45 

5.2.21 DA-09-02 ................................................................................................................ 48 

5.2.22 DA-09-16 ................................................................................................................ 51 

5.2.23 DA-09-64 ................................................................................................................ 54 

5.2.24 DA-10-BEST .......................................................................................................... 57

5.2.25 DA-10-PASSWORD .............................................................................................. 59 

5.2.26 DA-10-UNCOMPRESSED .................................................................................... 61 

5.2.27 DA-12 ..................................................................................................................... 63 

5.2.28 DA-13 ..................................................................................................................... 64 

5.2.29 DA-14-ATA28 ........................................................................................................ 66 

5.2.30 DA-14-ATA48 ........................................................................................................ 68 
 

August 2008 iv Test Results for EnCase 5.05f June 2008

5.2.31 DA-14-BEST .......................................................................................................... 70

5.2.32 DA-14-CF ............................................................................................................... 72 

5.2.33 DA-14-F12 .............................................................................................................. 74 

5.2.34 DA-14-F16 .............................................................................................................. 76 

5.2.35 DA-14-F32 .............................................................................................................. 78 

5.2.36 DA-14-F32-ALT ..................................................................................................... 80 

5.2.37 DA-14-F32X ........................................................................................................... 82 

5.2.38 DA-14-F32X-ALT .................................................................................................. 84 

5.2.39 DA-14-FLOPPY ..................................................................................................... 86 

5.2.40 DA-14-FW .............................................................................................................. 87 

5.2.41 DA-14-HOT ............................................................................................................ 89 

5.2.42 DA-14-NTFS .......................................................................................................... 91

5.2.43 DA-14-NTFS-ALT ................................................................................................. 93 

5.2.44 DA-14-PASSWORD .............................................................................................. 95 

5.2.45 DA-14-SCSI ............................................................................................................ 97 

5.2.46 DA-14-THUMB ...................................................................................................... 99 

5.2.47 DA-14-UNCOMPRESSED .................................................................................. 101 

5.2.48 DA-14-USB .......................................................................................................... 103

5.2.49 DA-17 ................................................................................................................... 105 

5.2.50 DA-22-ATA28 ...................................................................................................... 107 

5.2.51 DA-22-F16 ............................................................................................................ 109 

5.2.52 DA-24 ................................................................................................................... 111 

5.2.53 DA-25 ................................................................................................................... 113 
 

August 2008 v Test Results for EnCase 5.05f June 2008
Introduction 

The Computer Forensics Tool Testing (CFTT) program is a joint project of the National 

Institute of Justice (NIJ), the research and development organization of the U.S. 

Department of Justice (DOJ), and the National Institute of Standards and Technology’s 

(NIST’s) Office of Law Enforcement Standards, and Information Technology 

Laboratory . CFTT is supported by other organizations, including the Federal Bureau of 

Investigation (FBI), the U.S. Department of Defense Cyber Crime Center, U.S. Internal 

Revenue Service Criminal Investigation Division Electronic Crimes Program, and the 

U.S. Department of Homeland Security’s Bureau of Immigration and Customs 

Enforcement, U.S. Customs and Border Protection, and U.S. Secret Service. The 

objective of the CFTT program is to provide measurable assurance to practitioners, 

researchers, and other applicable users that the tools used in computer forensics 

investigations provide accurate results. Accomplishing this requires the development of 

specifications and test methods for computer forensics tools and subsequent testing of 

specific tools against those specifications. 

Test results provide the information necessary for developers to improve tools, users to 

make informed choices, and the legal community and others to understand the tools’ 

capabilities. This approach to testing computer forensic tools is based on well-recognized 

methodologies for conformance and quality testing. The specifications and test methods 

are posted on the CFTT Web site (http://www.cftt.nist.gov/) for review and comment by 

the computer forensics community. 

This document reports the results from testing EnCase, version 5.05f, against the Digital 

Data Acquisition Tool Assertions and Test Plan Version 1.0, available at the CFTT Web 

site (http://www.cftt.nist.gov/DA-ATP-pc-01.pdf). 

Test results from other software packages and the CFTT tool methodology can be found 

on NIJ’s computer forensics tool testing Web 

page, http://www.ojp.usdoj.gov/nij/topics/ecrime/cftt.htm. 
Test Results for Digital Data Acquisition Tool 

Tool Tested: EnCase 

Version: 5.05f 

Run Environments: Windows XP, Windows Server 2003 & Windows 2000 

Supplier: Guidance Software, Inc.

Address: 215 North Marengo Ave. 

Pasadena, CA 91101 

Tel: 626–229–9191 

Fax: 626–229–9199 

WWW: http://www.guidancesoftware.com/ 

1 Results Summary 

Except for three test cases (DA–07, DA–09, and DA–14), the tested tool acquired all 

visible and hidden sectors completely and accurately from the test media without any 

anomalies. The following five anomalies were observed: 

1. If a logical acquisition is made of an NTFS partition, a small number of sectors, 

seven in the executed test, appear in the image file twice, replacing seven other 

sectors that fail to be acquired (DA–07–NTFS). 

2. If a logical acquisition is made of an NTFS partition, the last physical sector of 

the partition is not acquired (DA–07–NTFS). 

3. If the tool attempts to acquire a defective sector with an error granularity greater 

than one sector, some readable sectors near the defective sector are replaced by 

zeros in the created image file (DA–09–02, DA–09–16, and DA–16–64). 

4. If the tool attempts to acquire a defective sector from an ATA drive while using 

FastBloc SE to write block the drive, no notification of faulty sectors is given to 

the user. 

5. For some partition types (FAT32 and NTFS) that have been imaged as a logical 

(partition) acquisition, if a logical restore is performed there may be a small 

number of differences in file system metadata between the image file and the 

restored partition (DA–14–F32, DA–14–F32X and DA–14–NTFS). The 

differences can be avoided by removing power from the destination drive instead 

of doing a normal power down sequence (DA–14–F32–ALT, DA–14–F32X–ALT 

and DA–14–NTFS–ALT). 

2 Test Case Selection 

Not all test cases or test assertions defined in Digital Data Acquisition Tool Assertions 

and Test Plan Version 1.0 are appropriate for all tools. In addition to the base test cases, 

each remaining test case is linked to optional tool features needed for the test case. If a 

given tool implements a given feature then the test cases linked to that feature are 

August 2008 2 of 114 Test Results for EnCase 5.05f June 2008
run. Table 1 lists the features available in EnCase and the linked test cases selected

execution. 

 for 

Table 2 lists the features not available in EnCase and the test cases not 

executed. 

Table 1 Selected Test Cases 

Supported Optional Feature Cases selected for execution 

Base Cases 06, 07 & 08 

Destination Device Switching 13 

Read error during acquisition 09 

Create an image file in more than one format 10 

Insufficient space for image file 12 

Create a clone from an image file 14 & 17 

Fill excess sectors on a clone device 22 

Detect a corrupted (or changed) image file 24 & 25 

Table 2 Omitted Test Cases 

Unsupported Optional Feature Cases omitted (not executed) 

Create a clone during acquisition 01, 02 & 04 

Create cylinder aligned clones 03, 15, 21 & 23 

Convert an image file from one format to 

another 

26 

Device I/O error generator available 05, 11 & 18 

Fill excess sectors acquired to a clone device 19 & 20 

Create a clone from a subset of an image file 16 

Some test cases have variant forms to accommodate parameters within test assertions. 

These variations cover the execution environment, acquisition interface to the source 

drive, and type of digital object acquired. Variations were also created for image file 

format. 

The tool was executed in one of the following Microsoft run time environments: 

Windows XP, Windows Server 2003 or Windows 2000. 

The following source interfaces were tested: ATA28, ATA48, network cable, USB, and 

FireWire. 

The following digital sources were tested: partitions (FAT12, FAT16, FAT32, FAT32X, 

and NTFS), compact flash, and thumb drive. 

The image files were created on either NTFS or FAT32 partitions. 

August 2008 3 of 114 Test Results for EnCase 5.05f June 2008
3 Results by Test Assertion 

Table 3 summarizes the test results by assertion. The column labeled Assertions Tested

gives the text of each assertion. The column labeled Tests gives the number of test cases 

that use the given assertion. The column labeled Anomaly gives the section number in 

this report where any anomalies found for the assertion are discussed. 

Table 3 Assertions Tested 

Assertions Tested Tests Anomaly

AM–01 The tool uses access interface SRC–AI to access the digital 

source. 

28 

AM–02 The tool acquires digital source DS. 28 

AM–03 The tool executes in execution environment XE. 53 

AM–05 If image file creation is specified, the tool creates an image 

file on file system type FS. 

28 

AM–06 All visible sectors are acquired from the digital source. 27 3.2

AM–07 All hidden sectors are acquired from the digital source. 3 

AM–08 All sectors acquired from the digital source are acquired 

accurately. 

27 3.1, 3.3

AM–09 If unresolved errors occur while reading from the selected 

digital source, the tool notifies the user of the error type and 

location within the digital source. 

4 3.3

AM–10 If unresolved errors occur while reading from the selected 

digital source, the tool uses a benign fill in the destination object in 

place of the inaccessible data. 

4 3.3

AO–01 If the tool creates an image file, the data represented by the 

image file is the same as the data acquired by the tool. 

27 

AO–02 If an image file format is specified, the tool creates an 

image file in the specified format. 

3 

AO–04 If the tool is creating an image file and there is insufficient 

space on the image destination device to contain the image file, the 

tool shall notify the user. 

2 

AO–05 If the tool creates a multi-file image of a requested size then 

all the individual files shall be no larger than the requested size. 

27 

AO–06 If the tool performs an image file integrity check on an 

image file that has not been changed since the file was created, the 

tool shall notify the user that the image file has not been changed. 

1 

AO–07 If the tool performs an image file integrity check on an 

image file that has been changed since the file was created, the tool 

shall notify the user that the image file has been changed. 

1 

AO–08 If the tool performs an image file integrity check on an 

image file that has been changed since the file was created, the tool 

shall notify the user of the affected locations. 

1 

AO–10 If there is insufficient space to contain all files of a multifile image and if destination device switching is supported, the 

image is continued on another device. 

1 

August 2008 4 of 114 Test Results for EnCase 5.05f June 2008
Assertions Tested Tests Anomaly

AO–12 If requested, a clone is created from an image file. 23 

AO–13 A clone is created using access interface DST–AI to write 

to the clone device. 

23 

AO–14 If an unaligned clone is created, each sector written to the 

clone is accurately written to the same disk address on the clone 

that the sector occupied on the digital source. 

22 3.4

AO–17 If requested, any excess sectors on a clone destination 

device are not modified. 

11 

AO–18 If requested, a benign fill is written to excess sectors of a 

clone. 

2 

AO–19 If there is insufficient space to create a complete clone, a 

truncated clone is created using all available sectors of the clone 

device. 

1 

AO–20 If a truncated clone is created, the tool notifies the user. 1 

AO–23 If the tool logs any log significant information, the 

information is accurately recorded in the log file. 

53 

Two test assertions only apply in special circumstances. The assertion AO–22 is checked 

only for tools that create block hashes. This assertion does not apply to EnCase. The 

assertion AO–24 is only checked if the tool is executed in a run time environment that 

does not modify attached storage devices, such as MS DOS. A write blocker was used 

during the tests, so assertion AO–24 was not checked. Table 4 lists the assertions that 

were not tested, usually due to the tool not supporting some optional feature, e.g., 

creation of cylinder aligned clones. 

Table 4 Assertions not Tested 

Assertions not Tested 

AM–04 If clone creation is specified, the tool creates a clone of the digital source. 

AO–03 If there is an error while writing the image file, the tool notifies the user. 

AO–09 If the tool converts a source image file from one format to a target image file in 

another format, the acquired data represented in the target image file is the same as the 

acquired data in the source image file. 

AO–11 If requested, a clone is created during an acquisition of a digital source. 

AO–15 If an aligned clone is created, each sector within a contiguous span of sectors 

from the source is accurately written to the same disk address on the clone device relative 

to the start of the span as the sector occupied on the original digital source. A span of 

sectors is defined to be either a mountable partition or a contiguous sequence of sectors 

not part of a mountable partition. Extended partitions, which may contain both mountable 

partitions and unallocated sectors, are not mountable partitions. 

AO–16 If a subset of an image or acquisition is specified, all the subset is cloned. 

AO–21 If there is a write error during clone creation, the tool notifies the user. 

AO–22 If requested, the tool calculates block hashes for a specified block size during an 

acquisition for each block acquired from the digital source. 

AO–24 If the tool executes in a forensically safe execution environment, the digital 

August 2008 5 of 114 Test Results for EnCase 5.05f June 2008
Assertions not Tested 

source is unchanged by the acquisition process. 

3.1 Logical Acquisition of NTFS Data Duplication 

Seven sectors (27,744,184--27,744,190) were not imaged correctly into the image file 

(DA–07–NTFS). The seven sectors were replaced in the image file by the content of 

seven other sectors (27,744,120––27,744,126). The actual content of sectors 27,744,184--

27,744,190 was not acquired. This result was verified by constructing a dd style image 

file that hashed to the same value as reported by the EnCase acquisition. 

3.2 Logical Acquisition of NTFS Last Sector Omitted 

The last physical sector of the NTFS partition was not acquired (DA–07–NTFS). The 

partition has 27,744,192 sectors. EnCase acquired the first 27,744,191 sectors. 

3.3 Acquisition of Faulty Sectors 

EnCase 5 allows specification of an error granularity that specifies the size of a window 

surrounding any encountered faulty sectors such that for any faulty sectors encountered 

the sectors within the window surrounding the faulty sector are replaced by zeros in the 

created image file. Variations of test case DA–09 were executed with error granularity of 

1, 2, 16 and 64. Variations DA–09–01, DA–09–02, and DA–09–16 were executed using a 

hardware write blocker and variation DA–09–64 was executed with FastBloc SE (a 

software write blocker). 

Variation DA–09–01 acquired all readable sectors and filled the faulty sectors place in 

the image file with zeros (expected behavior). Variations DA–09–02 and DA–09–16 

acquired, with the exception of readable sectors within granularity blocks surrounding 

faulty sectors, all readable sectors outside of granularity blocks surrounding faulty sectors. 

This is the behavior intended for the tool by the software vendor. 

For variation DA–09–64 there were two anomalies: (1) the user was not notified that 

faulty sectors were encountered on the source, and (2) each faulty sector was surrounded 

by a variable sized block (varying from 1 to 64 sectors) of sectors filled with non-zero 

data from an undetermined source (rather than the expected 64 sector zero filled blocks). 

3.4 Alternate Restore Procedure 

For certain partition types (FAT32 and NTFS), a logical restore of a partition is not an 

exact duplicate of the original (DA–14–F32, DA–14–F32X and DA–14–NTFS). The 

vendor documentation states that a logical restore cannot be verified as an exact copy of 

the source and is not recommended when seeking to create a bit-stream duplicate of the 

source. For FAT32 partitions, two file system control values (not part of any data file) are 

adjusted as a side effect of restoring an image to a destination. This adjustment is 

confined to about 8 bytes of sector 1, the first sector of the FAT table, and the first sector 

August 2008 6 of 114 Test Results for EnCase 5.05f June 2008
of the FAT table backup copy of the partition. For NTFS partitions, changes were made 

to about 40 sectors of the partition. In no case was there any effect on sectors used in data 

files. All sectors of the image file accurately reflected the original sectors. These changes 

to a restored partition (logical volume) may be a consequence of the Windows shutdown 

process.

One procedure to avoid this behavior during the normal Windows shutdown process is to 

crash the system by removing power without allowing Windows to shutdown. Because 

powering off the entire system suddenly could compromise the integrity of other files on 

the system, NIST modified this procedure to power off only the destination drive and 

then follow the normal Windows shutdown procedure. The result of the modified 

procedure was to eliminate the anomaly from the restored copy while maintaining the 

integrity of the remainder of the file system. The modified procedure was used for tests 

DA–14–F32–ALT, DA–14–F32X–ALT and DA–14–NTFS–ALT.

4 Testing Environment 

The tests were run in the NIST CFTT lab. This section describes the test computers 

available for testing. 

4.1 Test Computers 

Four test computers were used. 

Frank, Freddy, Joe, and Max have the following configuration: 

Intel Desktop Motherboard D865GB/D865PERC (with ATA–6 IDE on board controller) 

BIOS Version BF86510A.86A.0053.P13 

Adaptec SCSI BIOS V3.10.0 

Intel® PentiumTM 4 CPU 3.4Ghz 

2577972KB RAM 

SONY DVD RW DRU–530A, ATAPI CD/DVD-ROM drive 

1.44 MB floppy drive 

Two slots for removable IDE hard disk drives 

Two slots for removable SATA hard disk drives 

Two slots for removable SCSI hard disk drives 

4.2 Support Software 

A package of programs to support test analysis, FS–TST Release 2.0, was used. The 

software can be obtained from: http://www.cftt.nist.gov/diskimaging/fs-tst20.zip. 

5 Test Results 

The main item of interest for interpreting the test results is determining the conformance 

of the tool under test with the test assertions. Conformance with each assertion tested by a 

August 2008 7 of 114 Test Results for EnCase 5.05f June 2008
given test case is evaluated by examining the Log Highlights box of the test report 

summary. 

5.1 Test Results Report Key 

A summary of the actual test results is presented in this report. The following table 

presents a description of each section of the test report summary. 

Heading Description 

First Line: Test case ID, name, and version of tool tested. 

Case Summary: Test case summary from Digital Data Acquisition Tool 

Assertions and Test Plan Version 1.0.

Assertions: The test assertions applicable to the test case, selected from 

Digital Data Acquisition Tool Assertions and Test Plan 

Version 1.0.

Tester Name: Name or initials of person executing test procedure. 

Test Host: Host computer executing the test. 

Test Date: Time and date that test was started. 

Drives: Source drive (the drive acquired), destination drive (if a 

clone is created) and media drive (to contain a created 

image). 

Source Setup: Layout of partitions on the source drive and the expected 

hash of the drive. 

Log Highlights: Information extracted from various log files to illustrate 

conformance or nonconformance to the test assertions. 

Results: Expected and actual results for each assertion tested. 

Analysis: Whether or not the expected results were achieved. 

5.2 Test Details 

 

5.2.1 DA-06-ATA28 

Test Case DA-06-ATA28 EnCase 5.05f 

Case 

Summary: 

DA-06 Acquire a physical device using access interface AI to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file 

on file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, 

the digital source is unchanged by the acquisition process. 

August 2008 8 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-06-ATA28 EnCase 5.05f 

Tester Name: slm 

Test Host: joe 

Test Date: Wed Apr 18 16:18:23 2007 

Drives: src(43) dst (none) other (fat32) 

Source 

Setup: 

src hash (SHA1): < 888E2E7F7AD237DC7A732281DD93F325065E5871 > 

src hash (MD5): < BC39C3F7EE7A50E77B9BA1E65A5AEEF7 > 

78125000 total sectors (40000000000 bytes) 

Model (0BB-75JHC0 ) serial # ( WD-WMAMC46588) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057143205 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027712125 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027712062 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027712062 sectors 14188575744 bytes 

Log 

Highlights: 

Start: 04/17/07 10:46:06AM 

Acquisition Hash: BC39C3F7EE7A50E77B9BA1E65A5AEEF7 

Actual Date:04/17/07 10:46:06AM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:bc39c3f7ee7a50e77b9ba1e65a5aeef7 

Verify Hash:bc39c3f7ee7a50e77b9ba1e65a5aeef7 

EnCase Version:5.05f 

System Version:Windows 2000 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:40,000,000,000 bytes (37.3GB) 

Total Sectors:78,125,000 

Settings: fill none 

size cd 

Write Block: 4 FastBloc IDE 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

August 2008 9 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-06-ATA28 EnCase 5.05f 

Analysis: Expected results achieved 

August 2008 10 of 114 Test Results for EnCase 5.05f June 2008
5.2.2 DA-06-ATA48 

Test Case DA-06-ATA48 EnCase 5.05f 

Case 

Summary: 

DA-06 Acquire a physical device using access interface AI to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file 

on file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, 

the digital source is unchanged by the acquisition process. 

Tester Name: slm 

Test Host: joe 

Test Date: Wed Apr 18 16:40:06 2007 

Drives: src(4C) dst (none) other (fat32) 

Source 

Setup: 

src hash (SHA1): < 8FF620D2BEDCCAFE8412EDAAD56C8554F872EFBF > 

src hash (MD5): < D10F763B56D4CEBA2D1311C61F9FB382 > 

390721968 total sectors (200049647616 bytes) 

24320/254/63 (max cyl/hd values) 

24321/255/63 (number of cyl/hd) 

IDE disk: Model (WDC WD2000JB-00KFA0) serial # (WD-WMAMR1031111) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 390700737 0000/001/01 1023/254/63 Boot 07 NTFS 

 2 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 3 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 4 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 390700737 sectors 200038777344 bytes 

Log 

Highlights: 

Actual Date:04/13/07 05:36:50PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:d10f763b56d4ceba2d1311c61f9fb382 

Verify Hash:d10f763b56d4ceba2d1311c61f9fb382 

EnCase Version:5.05f 

System Version:Windows 2003 Server 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:200,049,647,616 bytes (186.3GB) 

Total Sectors:390,721,968 

Settings: fill none 

size fat 

Write Block: 4 FastBloc IDE 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

August 2008 11 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-06-ATA48 EnCase 5.05f 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 12 of 114 Test Results for EnCase 5.05f June 2008
5.2.3 DA-06-FLOPPY 

Test Case DA-06-FLOPPY EnCase 5.05f 

Case 

Summary: 

DA-06 Acquire a physical device using access interface AI to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file 

on file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, 

the digital source is unchanged by the acquisition process. 

Tester Name: slm 

Test Host: joe 

Test Date: Wed Apr 18 17:28:37 2007 

Drives: src(floppy) dst (none) other (fat32) 

Source 

Setup: 

src hash (SHA1): < e2863334ac7eaabc7c8a0d62eb0d3b3af29f2c40 > 

src hash (MD5): < 17f6a5925be2f38eedaf435ff8b6a6f4 > 

Floppy disk 

Log 

Highlights: 

Start: 04/18/07 06:26:27PM 

Acquisition Hash: 17F6A5925BE2F38EEDAF435FF8B6A6F4 

Total Capacity:1,457,664 bytes (1.4MB) 

Total Clusters:2,847Unallocated:1,380,352 bytes (1.3MB) 

OEM Version:MSDOS5.0Serial Number:AC00-86E5 

Actual Date:04/18/07 06:26:27PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:17f6a5925be2f38eedaf435ff8b6a6f4 

Verify Hash:17f6a5925be2f38eedaf435ff8b6a6f4 

EnCase Version:5.05f 

System Version:Windows 2000 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:1,474,560 bytes (1.4MB) 

Total Sectors:2,880 

Settings: fill none 

size cd 

Write Block: none 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 13 of 114 Test Results for EnCase 5.05f June 2008
5.2.4 DA-06-FW 

Test Case DA-06-FW EnCase 5.05f 

Case 

Summary: 

DA-06 Acquire a physical device using access interface AI to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file 

on file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, 

the digital source is unchanged by the acquisition process. 

Tester Name: slm 

Test Host: joe 

Test Date: Wed Apr 18 16:50:26 2007 

Drives: src(01) dst (none) other (fat32) 

Source 

Setup: 

src hash (SHA1): < A48BB5665D6DC57C22DB68E2F723DA9AA8DF82B9 > 

src hash (MD5): < F458F673894753FA6A0EC8B8EC63848E > 

78165360 total sectors (40020664320 bytes) 

Model (0BB-00JHC0 ) serial # ( WD-WMAMC74171) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057175335 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027744255 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027744192 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027744192 sectors 14205026304 bytes 

Log 

Highlights: 

Start: 04/13/07 04:32:03PM 

Acquisition Hash: F458F673894753FA6A0EC8B8EC63848E 

Actual Date:04/13/07 04:32:03PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:f458f673894753fa6a0ec8b8ec63848e 

Verify Hash:f458f673894753fa6a0ec8b8ec63848e 

EnCase Version:5.05f 

System Version:Windows XP 

Error Granularity:64 

Read Errors:0 

August 2008 14 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-06-FW EnCase 5.05f 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:40,020,664,320 bytes (37.3GB) 

Total Sectors:78,165,360 

Settings: fill none 

size cd 

Write Block: fastbloc FE 37 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 15 of 114 Test Results for EnCase 5.05f June 2008
5.2.5 DA-06-NCAB-ENBD 

Test Case DA-06-NCAB-ENBD EnCase 5.05f 

Case 

Summary: 

DA-06 Acquire a physical device using access interface AI to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file 

on file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, 

the digital source is unchanged by the acquisition process. 

Tester Name: Joe 

Test Host: mrmw 

Test Date: Thu Dec 20 16:53:30 2007 

Drives: src(43) dst (none) other (01-FU) 

Source 

Setup: 

src hash (SHA1): < 888E2E7F7AD237DC7A732281DD93F325065E5871 > 

src hash (MD5): < BC39C3F7EE7A50E77B9BA1E65A5AEEF7 > 

78125000 total sectors (40000000000 bytes) 

Model (0BB-75JHC0 ) serial # ( WD-WMAMC46588) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057143205 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027712125 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027712062 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027712062 sectors 14188575744 bytes 

Log 

Highlights: 

Start: 12/20/07 05:44:44PM 

Acquisition Hash: BC39C3F7EE7A50E77B9BA1E65A5AEEF7 

Actual Date:12/20/07 05:44:44PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:bc39c3f7ee7a50e77b9ba1e65a5aeef7 

Verify Hash:bc39c3f7ee7a50e77b9ba1e65a5aeef7 

EnCase Version:5.05f 

System Version:Windows 2003 Server 

Error Granularity:64 

Read Errors:0 

August 2008 16 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-06-NCAB-ENBD EnCase 5.05f 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:40,000,000,000 bytes (37.3GB) 

Total Sectors:78,125,000 

Settings: size CD 

fill none 

Write Block: none 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 17 of 114 Test Results for EnCase 5.05f June 2008
5.2.6 DA-06-NCAB-LINEN 

Test Case DA-06-NCAB-LINEN EnCase 5.05f 

Case 

Summary: 

DA-06 Acquire a physical device using access interface AI to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file on 

file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, the 

digital source is unchanged by the acquisition process. 

Tester 

Name: 

mrmw 

Test Host: Freddy 

Test Date: Thu Dec 20 18:16:08 2007 

Drives: src(c1-cf) dst (none) other (06-fu) 

Source 

Setup: 

src hash (SHA256): < 

C7CF0218222DF80D5316511D6814266C7FA507C13F795AD3D323BB73C1590D80 > 

src hash (SHA1): < 5B8235178DF99FA307430C088F81746606638A0B > 

src hash (MD5): < 776DF8B4D2589E21DEBCF589EDC16D78 > 

503808 total sectors (257949696 bytes) 

Model ( CF) serial # () 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 778135908 1141509631 0357/116/40 0357/032/45 Boot 72 other 

 2 P 168689522 1936028240 0288/115/43 0367/114/50 Boot 65 other 

 3 P 1869881465 1936028192 0366/032/33 0357/032/43 Boot 79 other 

 4 P 2885681152 000055499 0372/097/50 0000/010/00 Boot 0D other 

1 1141509631 sectors 584452931072 bytes 

2 1936028240 sectors 991246458880 bytes 

3 1936028192 sectors 991246434304 bytes 

4 000055499 sectors 28415488 bytes 

Log 

Highlights: 

Start: 12/20/07 06:22:18PM 

Acquisition Hash: 776DF8B4D2589E21DEBCF589EDC16D78 

Actual Date:12/20/07 06:22:18PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:776df8b4d2589e21debcf589edc16d78 

Verify Hash:776df8b4d2589e21debcf589edc16d78 

EnCase Version:5.05f 

System Version:Windows 2000 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:257,949,696 bytes (246MB) 

Total Sectors:503,808 

Settings: size CD 

fill none 

Write Block: none 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

August 2008 18 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-06-NCAB-LINEN EnCase 5.05f 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 19 of 114 Test Results for EnCase 5.05f June 2008
5.2.7 DA-06-PART 

Test Case DA-06-PART EnCase 5.05f 

Case 

Summary: 

DA-06 Acquire a physical device using access interface AI to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file 

on file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, 

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 

Test Host: Frank 

Test Date: Wed Jun 20 11:01:43 2007 

Drives: src(24-FU2) dst (none) other (02-fU) 

Source 

Setup: 

src hash (SHA1): < A78EDB5E90298D0CDF199B4B62119F81208A252A > 

src hash (MD5): < 90311DDF672B8CBA0869A46F4A455A7E > 

39070080 total sectors (20003880960 bytes) 

19076/063/32 (max cyl/hd values) 

19077/064/32 (number of cyl/hd) 

Model (ATCS04-0 ) serial # ( CSH206D9DSEL) 

MD5 sectors 3907008-7814015 drive 24-fu2: 4392FA47D09ED9BE561E30F6E3CCC03D 

Log 

Highlights: 

Start: 06/20/07 11:24:04AM 

Acquisition Hash: 90311DDF672B8CBA0869A46F4A455A7E 

Start: 06/20/07 12:07:41PM 

Start Sector: 3,907,008 

Stop Sector: 7,814,015 

Hash Value: 4392FA47D09ED9BE561E30F6E3CCC03D 

Settings: fill none 

size cdWrite Block: tableau USB writeblocker 18 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 20 of 114 Test Results for EnCase 5.05f June 2008
5.2.8 DA-06-SCSI 

Test Case DA-06-SCSI EnCase 5.05f 

Case 

Summary: 

DA-06 Acquire a physical device using access interface AI to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file on 

file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, the 

digital source is unchanged by the acquisition process. 

Tester 

Name: 

mrmw 

Test Host: Frank 

Test Date: Thu Apr 12 09:26:34 2007 

Drives: src(2A) dst (none) other (IDE) 

Source 

Setup: 

src hash (SHA256): < 

AE8E839101661367D92803D5F5D408268635EFD8A05FEA633838CDC3919F5ABA > 

src hash (SHA1): < F5F9F2903DCAB895F36E270FB22A722E27918125 > 

src hash (MD5): < 91E0AC905F682ECF6DE4E9835089B519 > 

17783249 total sectors (9105023488 bytes) 

Model (QM39100TD-SCA ) serial # (PCB=20-116711-06 HDAQM39100TD-SCA ) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 017751762 0000/001/01 1023/254/63 Boot 07 NTFS 

 2 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 3 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 4 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 017751762 sectors 9088902144 bytes 

Log 

Highlights: 

Start: 04/12/07 01:42:32PM 

Acquisition Hash: 91E0AC905F682ECF6DE4E9835089B519 

Actual Date:04/12/07 01:42:32PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:91e0ac905f682ecf6de4e9835089b519 

Verify Hash:91e0ac905f682ecf6de4e9835089b519 

EnCase Version:5.05f 

System Version:Windows XP 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:9,105,023,488 bytes (8.5GB) 

Total Sectors:17,783,249 

Settings: size CD(640 MB) fill none block size 64 

Write Block: FastBloc SE 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

August 2008 21 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-06-SCSI EnCase 5.05f 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 22 of 114 Test Results for EnCase 5.05f June 2008
5.2.9 DA-06-USB 

Test Case DA-06-USB EnCase 5.05f 

Case 

Summary: 

DA-06 Acquire a physical device using access interface AI to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file 

on file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, 

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 

Test Host: Frank 

Test Date: Fri Apr 6 08:17:56 2007 

Drives: src(01) dst (none) other (IDE) 

Source 

Setup: 

src hash (SHA1): < A48BB5665D6DC57C22DB68E2F723DA9AA8DF82B9 > 

src hash (MD5): < F458F673894753FA6A0EC8B8EC63848E > 

78165360 total sectors (40020664320 bytes) 

Model (0BB-00JHC0 ) serial # ( WD-WMAMC74171) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057175335 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027744255 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027744192 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027744192 sectors 14205026304 bytes 

Log 

Highlights: 

Start: 04/06/07 12:38:27PM 

Acquisition Hash: F458F673894753FA6A0EC8B8EC63848E 

Actual Date:04/06/07 12:38:27PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:f458f673894753fa6a0ec8b8ec63848e 

Verify Hash:f458f673894753fa6a0ec8b8ec63848e 

EnCase Version:5.05f 

System Version:Windows 2000 

Error Granularity:64 

Read Errors:0 

August 2008 23 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-06-USB EnCase 5.05f 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:40,020,664,320 bytes (37.3GB) 

Total Sectors:78,165,360 

Settings: size CD (640MB) fill none blocksize 64 

Write Block: 37 WiebeTech Combo Dock 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 24 of 114 Test Results for EnCase 5.05f June 2008
5.2.10 DA-07-CF 

Test Case DA-07-CF EnCase 5.05f 

Case 

Summary: 

DA-07 Acquire a digital source of type DS to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file on 

file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, the 

digital source is unchanged by the acquisition process. 

Tester 

Name: 

slm 

Test Host: joe 

Test Date: Tue Apr 3 15:09:00 2007 

Drives: src(c1-cf) dst (none) other (ntfs) 

Source 

Setup: 

src hash (SHA256): < 

C7CF0218222DF80D5316511D6814266C7FA507C13F795AD3D323BB73C1590D80 > 

src hash (SHA1): < 5B8235178DF99FA307430C088F81746606638A0B > 

src hash (MD5): < 776DF8B4D2589E21DEBCF589EDC16D78 > 

503808 total sectors (257949696 bytes) 

Model ( CF) serial # () 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 778135908 1141509631 0357/116/40 0357/032/45 Boot 72 other 

 2 P 168689522 1936028240 0288/115/43 0367/114/50 Boot 65 other 

 3 P 1869881465 1936028192 0366/032/33 0357/032/43 Boot 79 other 

 4 P 2885681152 000055499 0372/097/50 0000/010/00 Boot 0D other 

1 1141509631 sectors 584452931072 bytes 

2 1936028240 sectors 991246458880 bytes 

3 1936028192 sectors 991246434304 bytes 

4 000055499 sectors 28415488 bytes 

Log 

Highlights: 

Start: 04/03/07 04:58:51PM 

Acquisition Hash: 776DF8B4D2589E21DEBCF589EDC16D78 

Actual Date:04/03/07 04:58:51PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:776df8b4d2589e21debcf589edc16d78 

Verify Hash:776df8b4d2589e21debcf589edc16d78 

EnCase Version:5.05f 

System Version:Windows 2003 Server 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:257,949,696 bytes (246MB) 

Total Sectors:503,808 

Settings: Size cd 

fill noneWrite Block: 7 UltraBlock FCR 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

August 2008 25 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-07-CF EnCase 5.05f 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 26 of 114 Test Results for EnCase 5.05f June 2008
5.2.11 DA-07-F12 

Test Case DA-07-F12 EnCase 5.05f 

Case 

Summary: 

DA-07 Acquire a digital source of type DS to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file 

on file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, 

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 

Test Host: Frank 

Test Date: Wed Jun 20 14:14:50 2007 

Drives: src(01) dst (none) other (02-fu) 

Source 

Setup: 

src hash (SHA1): < A48BB5665D6DC57C22DB68E2F723DA9AA8DF82B9 > 

src hash (MD5): < F458F673894753FA6A0EC8B8EC63848E > 

78165360 total sectors (40020664320 bytes) 

Model (0BB-00JHC0 ) serial # ( WD-WMAMC74171) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057175335 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027744255 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027744192 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027744192 sectors 14205026304 bytes 

01F12-md5 16418303 E20E3CFEA80BF6F2D2AA75E829CC8CD9 

01F12-sha1 16418303 F8B72B65436DE3BD394ACFF71D405D0389C0E9B7 

Log 

Highlights: 

Start: 06/20/07 03:01:39PM 

Acquisition Hash: E20E3CFEA80BF6F2D2AA75E829CC8CD9 

Settings: fill none 

size cdWrite Block: fastbloc FE 44 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

August 2008 27 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-07-F12 EnCase 5.05f 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 28 of 114 Test Results for EnCase 5.05f June 2008
5.2.12 DA-07-F16 

Test Case DA-07-F16 EnCase 5.05f 

Case 

Summary: 

DA-07 Acquire a digital source of type DS to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file 

on file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, 

the digital source is unchanged by the acquisition process. 

Tester Name: slm 

Test Host: joe 

Test Date: Fri Apr 20 10:05:29 2007 

Drives: src(43) dst (none) other (fat32) 

Source 

Setup: 

src hash (SHA1): < 888E2E7F7AD237DC7A732281DD93F325065E5871 > 

src hash (MD5): < BC39C3F7EE7A50E77B9BA1E65A5AEEF7 > 

78125000 total sectors (40000000000 bytes) 

Model (0BB-75JHC0 ) serial # ( WD-WMAMC46588) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057143205 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027712125 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027712062 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027712062 sectors 14188575744 bytes 

43F16-md5sum 1077479423 37E81FFB31C3CB38AA48B2237500908E 

Log 

Highlights: 

Start: 04/20/07 10:26:36AM 

Acquisition Hash: 37E81FFB31C3CB38AA48B2237500908E 

Total Capacity:1,077,313,536 bytes (1GB) 

Total Clusters:32,877Unallocated:1,076,953,088 bytes (1GB) 

OEM Version:MSWIN4.0Serial Number:CCCF-3DAD 

Actual Date:04/20/07 10:26:36AM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:37e81ffb31c3cb38aa48b2237500908e 

Verify Hash:37e81ffb31c3cb38aa48b2237500908e 

August 2008 29 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-07-F16 EnCase 5.05f 

EnCase Version:5.05f 

System Version:Windows 2003 Server 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:1,077,479,424 bytes (1GB) 

Total Sectors:2,104,452 

Settings: size fat 

Write Block: 42 FastBloc LE 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 30 of 114 Test Results for EnCase 5.05f June 2008
5.2.13 DA-07-F32 

Test Case DA-07-F32 EnCase 5.05f 

Case 

Summary: 

DA-07 Acquire a digital source of type DS to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file 

on file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, 

the digital source is unchanged by the acquisition process. 

Tester Name: slm 

Test Host: joe 

Test Date: Tue Apr 10 15:00:04 2007 

Drives: src(01) dst (none) other (ntfs) 

Source 

Setup: 

src hash (SHA1): < A48BB5665D6DC57C22DB68E2F723DA9AA8DF82B9 > 

src hash (MD5): < F458F673894753FA6A0EC8B8EC63848E > 

78165360 total sectors (40020664320 bytes) 

Model (0BB-00JHC0 ) serial # ( WD-WMAMC74171) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057175335 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027744255 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027744192 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027744192 sectors 14205026304 bytes 

01F32-md5 4301789183 BFF7DC64C54339DA2A9D7972C076B514 

01F32-sha1 4301789183 B861D9E999F39750B484FFB693FF69DEC090C6B8 

Log 

Highlights: 

Start: 04/10/07 03:30:02PM 

Acquisition Hash: BFF7DC64C54339DA2A9D7972C076B514 

Total Capacity:4,293,382,144 bytes (4GB) 

Total Clusters:1,048,189Unallocated:4,292,919,296 bytes (4GB) 

OEM Version:MSWIN4.1Serial Number:5AEE-05B5 

Actual Date:04/10/07 03:30:02PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:bff7dc64c54339da2a9d7972c076b514 

August 2008 31 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-07-F32 EnCase 5.05f 

Verify Hash:bff7dc64c54339da2a9d7972c076b514 

EnCase Version:5.05f 

System Version:Windows XP 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:4,301,789,184 bytes (4GB) 

Total Sectors:8,401,932 

Settings: fill none 

size cd 

Write Block: 44 FastBloc FE 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 32 of 114 Test Results for EnCase 5.05f June 2008
5.2.14 DA-07-F32X 

Test Case DA-07-F32X EnCase 5.05f 

Case 

Summary: 

DA-07 Acquire a digital source of type DS to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file 

on file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, 

the digital source is unchanged by the acquisition process. 

Tester Name: slm 

Test Host: joe 

Test Date: Fri Apr 20 10:27:17 2007 

Drives: src(43) dst (none) other (fat32) 

Source 

Setup: 

src hash (SHA1): < 888E2E7F7AD237DC7A732281DD93F325065E5871 > 

src hash (MD5): < BC39C3F7EE7A50E77B9BA1E65A5AEEF7 > 

78125000 total sectors (40000000000 bytes) 

Model (0BB-75JHC0 ) serial # ( WD-WMAMC46588) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057143205 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027712125 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027712062 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027712062 sectors 14188575744 bytes 

43F32x-md5sum 10742183424 5980CB0FA68E9862C65765DF50F00906 

Log 

Highlights: 

Start: 04/20/07 10:37:36AM 

Acquisition Hash: 5980CB0FA68E9862C65765DF50F00906 

Total Capacity:10,731,683,840 bytes (10GB) 

Total Clusters:1,310,020Unallocated:10,729,906,176 bytes (10GB) 

OEM Version:MSWIN4.1Serial Number:4445-13C7 

Actual Date:04/20/07 10:37:36AM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:5980cb0fa68e9862c65765df50f00906 

Verify Hash:5980cb0fa68e9862c65765df50f00906 

August 2008 33 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-07-F32X EnCase 5.05f 

EnCase Version:5.05f 

System Version:Windows 2000 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:10,742,183,424 bytes (10GB) 

Total Sectors:20,980,827 

Settings: size fat 

Write Block: 42 FastBloc LE 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 34 of 114 Test Results for EnCase 5.05f June 2008
5.2.15 DA-07-NTFS 

Test Case DA-07-NTFS EnCase 5.05f 

Case 

Summary: 

DA-07 Acquire a digital source of type DS to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file on 

file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, the 

digital source is unchanged by the acquisition process. 

Tester 

Name: 

slm 

Test Host: joe 

Test Date: Tue Apr 10 10:23:53 2007 

Drives: src(01) dst (none) other (nfts) 

Source 

Setup: 

src hash (SHA1): < A48BB5665D6DC57C22DB68E2F723DA9AA8DF82B9 > 

src hash (MD5): < F458F673894753FA6A0EC8B8EC63848E > 

78165360 total sectors (40020664320 bytes) 

Model (0BB-00JHC0 ) serial # ( WD-WMAMC74171) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057175335 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027744255 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027744192 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027744192 sectors 14205026304 bytes 

01NTFS-md5 14205026303 92B27B30BEE8B0FFBA8C660FA1590D49 

01NTFS-sha1 14205026303 0FBA4C36295CB9622CD815577429C3A588C34D09 

01NTFS-sha256 14205026303 

65FCD168163625E5EB74255B2A981B6F1C9D6259AF8A0851369101986A7ABC09 

Log 

Highlights: 

Start: 04/10/07 11:22:50AM 

Acquisition Hash: 494A6ED8A827AD9B5403E0CC89379956 

Total Capacity:14,205,022,208 bytes (13.2GB) 

Total Clusters:3,468,023Unallocated:14,137,028,608 bytes (13.2GB) 

Actual Date:04/10/07 11:22:50AM 

August 2008 35 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-07-NTFS EnCase 5.05f 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:494a6ed8a827ad9b5403e0cc89379956 

Verify Hash:494a6ed8a827ad9b5403e0cc89379956 

EnCase Version:5.05f 

System Version:Windows XP 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:14,205,025,792 bytes (13.2GB) 

Total Sectors:27,744,191 

Settings: fill none 

size cd 

Write Block: 44 FastBloc FE 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. one sector missed 

AM-08 All sectors accurately acquired. some sectors differ 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results not achieved 

August 2008 36 of 114 Test Results for EnCase 5.05f June 2008
5.2.16 DA-07-THUMB 

Test Case DA-07-THUMB EnCase 5.05f 

Case 

Summary: 

DA-07 Acquire a digital source of type DS to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file 

on file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, 

the digital source is unchanged by the acquisition process. 

Tester Name: slm 

Test Host: joe 

Test Date: Fri Apr 20 17:05:01 2007 

Drives: src(d5-thumb) dst (none) other (fat32) 

Source 

Setup: 

src hash (SHA1): < D68520EF74A336E49DCCF83815B7B08FDC53E38A > 

src hash (MD5): < C843593624B2B3B878596D8760B19954 > 

505856 total sectors (258998272 bytes) 

Model (usb2.0Flash Disk) serial # () 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 778135908 1141509631 0357/116/40 0357/032/45 Boot 72 other 

 2 P 168689522 1936028240 0288/115/43 0367/114/50 Boot 65 other 

 3 P 1869881465 1936028192 0366/032/33 0357/032/43 Boot 79 other 

 4 P 2885681152 000055499 0372/097/50 0000/010/00 Boot 0D other 

1 1141509631 sectors 584452931072 bytes 

2 1936028240 sectors 991246458880 bytes 

3 1936028192 sectors 991246434304 bytes 

4 000055499 sectors 28415488 bytes 

Log 

Highlights: 

Start: 04/20/07 05:54:50PM 

Acquisition Hash: C843593624B2B3B878596D8760B19954 

Total Capacity:257,970,176 bytes (246MB) 

Total Clusters:125,962Unallocated:257,517,568 bytes (245.6MB) 

OEM Version:MSDOS5.0Serial Number:5C65-70D0 

Actual Date:04/20/07 05:54:50PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:c843593624b2b3b878596d8760b19954 

Verify Hash:c843593624b2b3b878596d8760b19954 

EnCase Version:5.05f 

System Version:Windows XP 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:258,998,272 bytes (247MB) 

Total Sectors:505,856 

Settings: fill none 

Size CDWrite Block: 18 Tableau Forensic USB Bridge 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

August 2008 37 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-07-THUMB EnCase 5.05f 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 38 of 114 Test Results for EnCase 5.05f June 2008
5.2.17 DA-08-ATA28 

Test Case DA-08-ATA28 EnCase 5.05f 

Case 

Summary: 

DA-08 Acquire a physical drive with hidden sectors to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file 

on file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-07 All hidden sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, 

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 

Test Host: Freddy 

Test Date: Fri Aug 31 15:15:21 2007 

Drives: src(42) dst (none) other (04-FU) 

Source 

Setup: 

src hash (SHA1): < 5A75399023056E0EB905082B35F8FAA1DB049229 > 

src hash (MD5): < F4B9AAB24554EEEB2A962BDA554A9252 > 

78165360 total sectors (40020664320 bytes) 

65534/015/63 (max cyl/hd values) 

65535/016/63 (number of cyl/hd) 

IDE disk: Model (WDC WD400JB-00JJC0) serial # (WD-WCAMA3958512) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 070348572 0000/001/01 1023/254/63 Boot 07 NTFS 

 2 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 3 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 4 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 070348572 sectors 36018468864 bytes 

HPA created 

BIOS, XBIOS and Direct disk geometry Reporter (BXDR) 

BXDR 128 /S70000000 /P /fbxdrlog.txt 

Setting Maximum Addressable Sector to 70000000 

MAS now set to 70000000 

Hashes with HPA in place 

md5:9BF3C3DEADE47056A1DDC073C5F6B2E2 

sha1:D76F909482B00767B62C295CADE202F92E61CD2E 

Log 

Highlights: 

Start: 08/31/07 04:42:49PM 

Acquisition Hash: F4B9AAB24554EEEB2A962BDA554A9252 

Start: 08/31/07 05:05:29PM 

Actual Date:08/31/07 04:42:49PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:f4b9aab24554eeeb2a962bda554a9252 

Verify Hash:f4b9aab24554eeeb2a962bda554a9252 

EnCase Version:5.05f 

System Version:Windows 2003 Server 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:40,020,664,320 bytes (37.3GB) 

Total Sectors:78,165,360 

 

Rehash of Source SHA1: 5A75399023056E0EB905082B35F8FAA1DB049229 

Settings: size CD (640 MB) 

August 2008 39 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-08-ATA28 EnCase 5.05f 

 fill none 

Write Block: Fastbloc SE 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-07 All hidden sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. as expected 

 

Analysis: Expected results achieved 

August 2008 40 of 114 Test Results for EnCase 5.05f June 2008
5.2.18 DA-08-ATA48 

Test Case DA-08-ATA48 EnCase 5.05f 

Case 

Summary: 

DA-08 Acquire a physical drive with hidden sectors to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file 

on file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-07 All hidden sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, 

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 

Test Host: Freddy 

Test Date: Fri Aug 31 13:52:37 2007 

Drives: src(4B) dst (none) other (01-FU) 

Source 

Setup: 

src hash (SHA1): < F409920836FED76DBB60DEEEF467A6DDED5BF48E > 

src hash (MD5): < B5641B5A594912B4D60518304B1DE698 > 

390721968 total sectors (200049647616 bytes) 

24320/254/63 (max cyl/hd values) 

24321/255/63 (number of cyl/hd) 

IDE disk: Model (WDC WD2000JB-00GVC0) serial # (WD-WCAL78252964) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 351646722 0000/001/01 1023/254/63 Boot 07 NTFS 

 2 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 3 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 4 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 351646722 sectors 180043121664 bytes 

HPA created 

BIOS, XBIOS and Direct disk geometry Reporter (BXDR) 

BXDR 128 /S351000000 /P /fHPA.TXT 

Setting Maximum Addressable Sector to 351000000 

MAS now set to 351000000 

Hashes with HPA in place 

md5:6BAFEFC000470C126434D933429C879B 

sha1:2D50DBD82CD3DA90A6E5BF13B2B40808C40998A1 

Log 

Highlights: 

Start: 08/31/07 02:36:22PM 

Acquisition Hash: B5641B5A594912B4D60518304B1DE698 

Total Capacity:180,043,120,640 bytes (167.7GB) 

Total Clusters:43,955,840Unallocated:177,459,097,600 bytes (165.3GB) 

 

Rehash of Source SHA1: F409920836FED76DBB60DEEEF467A6DDED5BF48E 

Settings: size CD (640 MB) 

 fill none 

Write Block: FastBloc SE 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-07 All hidden sectors acquired. as expected 

August 2008 41 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-08-ATA48 EnCase 5.05f 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. as expected 

 

Analysis: Expected results achieved 

August 2008 42 of 114 Test Results for EnCase 5.05f June 2008
5.2.19 DA-08-DCO 

Test Case DA-08-DCO EnCase 5.05f 

Case 

Summary: 

DA-08 Acquire a physical drive with hidden sectors to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file 

on file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-07 All hidden sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, 

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 92 

Test Host: Frank 

Test Date: Fri Aug 31 16:29:51 2007 

Drives: src(92) dst (none) other (04-FU) 

Source 

Setup: 

src hash (SHA1): < 63E6F7BD3040A8ADA2CF8FBF66A805B76DF10481 > 

src hash (MD5): < E095DD1BD0B0DD6E603153A3FE1A2F3E > 

58633344 total sectors (30020272128 bytes) 

58167/015/63 (max cyl/hd values) 

58168/016/63 (number of cyl/hd) 

IDE disk: Model (WDC WD300BB-00CAA0) serial # (WD-WMA8H2140350) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 058605057 0000/001/01 1023/254/63 Boot 07 NTFS 

 2 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 3 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 4 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 058605057 sectors 30005789184 bytes 

Hashes with DCO in place: 

md5:525963C6789423396FE1F3202A8CBD04 

sha1.txt:55A3CFE756B7B0034DCCE71F7D7A477D8681B781 

Log 

Highlights: 

 

Comparision of original to clone Drive 

Sectors compared: 58633344 

Sectors match: 58633344 

Sectors differ: 0 

Bytes differ: 0 

Diffs range 

0 source read errors, 0 destination read errors 

 

Actual Date:08/31/07 05:55:36PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:e095dd1bd0b0dd6e603153a3fe1a2f3e 

Verify Hash:e095dd1bd0b0dd6e603153a3fe1a2f3e 

EnCase Version:5.05f 

System Version:Windows 2003 Server 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:30,020,272,128 bytes (28GB) 

Total Sectors:58,633,344 

 

Rehash of Source SHA1: 63E6F7BD3040A8ADA2CF8FBF66A805B76DF10481 

Settings: size CD (640 MB) 

August 2008 43 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-08-DCO EnCase 5.05f 

 fill none 

Write Block: Fastbloc SE 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-07 All hidden sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. as expected 

 

Analysis: Expected results achieved 

August 2008 44 of 114 Test Results for EnCase 5.05f June 2008
5.2.20 DA-09-01 

Test Case DA-09-01 EnCase 5.05f 

Case 

Summary: 

DA-09 Acquire a digital source that has at least one faulty data sector. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file on 

file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AM-09 If unresolved errors occur while reading from the selected digital 

source, the tool notifies the user of the error type and location within the 

digital source. 

AM-10 If unresolved errors occur while reading from the selected digital 

source, the tool uses a benign fill in the destination object in place of 

the inaccessible data. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, the 

digital source is unchanged by the acquisition process. 

Tester 

Name: 

mrmw 

Test Host: Joe 

Test Date: Thu May 17 10:32:17 2007 

Drives: src(CPR1) dst (28-IDE) other (02-FU) 

Source 

Setup: 

No before hash for CPR1 120103200 total sectors (61492838400 bytes) 

 Drive with known bad sectors 

 Vendor: Maxtor Model: DiamondMax Plus 9 

Known Bad Sector List for ED-CPR-BAD-1 

Manufacturer: Maxtor 

Model: 6Y060L0 DiamondMax Plus 9 

Serial Number: Y27KR6CE 

Capacity: 60GB 

Interface: PATA 

54 faulty sectors 

10069095, 10069911, 12023808, 18652594, 18656041, 18656857, 18660303, 

18661119, 19746716-19746717, 22233904, 23098370, 23383001, 24102466-

24102467, 24104250, 24106656, 24107458, 28959971-28959972, 41825791, 

41828995, 52654580, 52655318, 60522984, 68643842-68643843, 69973290, 

72714626, 72715293, 82148809, 82148810, 83810525, 85310861, 85313430, 

85314038-85314039, 86321211, 86323780, 87186066, 87856313, 87856922, 

97191260-97191261, 100093150-100093151, 103861021, 109706975-109706976, 

110347947, 110350122-110350123, 115664758, 115835518 

Log 

Highlights: 

Destination setup 

488397168 sectors wiped with 28 

 

Comparision of original to clone Drive 

Sectors compared: 120103200 

Sectors match: 120103146 

Sectors differ: 54 

Bytes differ: 27594 

Diffs range 10069095, 10069911, 12023808, 18652594, 

18656041, 18656857, 18660303, 18661119, 19746716-19746717, 

22233904, 23098370, 23383001, 24102466-24102467, 24104250, 

24106656, 24107458, 28959971-28959972, 41825791, 41828995, 

52654580, 52655318, 60522984, 68643842-68643843, 69973290, 

August 2008 45 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-09-01 EnCase 5.05f 

72714626, 72715293, 82148809-82148810, 83810525, 85310861, 

85313430, 85314038-85314039, 86321211, 86323780, 87186066, 

87856313, 87856922, 97191260-97191261, 100093150-100093151, 

103861021, 109706975-109706976, 110347947, 110350122-110350123, 

115664758, 115835518 

Source (120103200) has 368293968 fewer sectors than destination (488397168) 

Zero fill: 0 

Src Byte fill (ED): 0 

Dst Byte fill (28): 368293968 

Other fill: 0 

Other no fill: 0 

Zero fill range: 

Src fill range: 

Dst fill range: 120103200-488397167 

Other fill range: 

Other not filled range: 

0 source read errors, 0 destination read errors 

 

Start: 05/17/07 11:47:54AM 

Acquisition Hash: EF3E63C324522760C838F2A93B7180D3 

Actual Date: 05/17/07 11:47:54AM 

EnCase Version: 5.05f 

System Version: Windows XP 

Error Granularity: 1 

Read Errors: 44 

Missing Sector Errors: 0 

CRC Errors: 0 

Total Size: 61,492,838,400 bytes (57.3GB) 

Total Sectors: 120,103,200 

Read Errors: 44 

Missing Sector Errors: 0 

CRC Errors: 0 

Compression: Good 

 Read Errors 

 Start Sector Sectors 

10,069,911 1 

12,023,808 1 

18,652,594 1 

18,656,041 1 

18,656,857 1 

18,660,303 1 

18,661,119 1 

19,746,716 2 

22,233,904 1 

23,098,370 1 

23,383,001 1 

24,102,466 2 

24,104,250 1 

24,106,656 1 

24,107,458 1 

28,959,971 2 

41,825,791 1 

41,828,995 1 

52,654,580 1 

52,655,318 1 

60,522,984 1 

68,643,842 2 

69,973,290 1 

72,714,626 1 

72,715,293 1 

82,148,809 2 

83,810,525 1 

85,310,861 1 

85,313,430 1 

85,314,038 2 

86,321,211 1 

86,323,780 1 

87,186,066 1 

August 2008 46 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-09-01 EnCase 5.05f 

87,856,313 1 

87,856,922 1 

97,191,260 2 

100,093,150 2 

103,861,021 1 

109,706,975 2 

110,347,947 1 

110,350,122 2 

115,664,758 1 

115,835,518 1 

 Total Size: 61,492,838,400 bytes (57.3GB) 

Total Sectors: 120,103,200 

 Cannot read the partition table 

2 different run lengths observed in 44 runs 

34 runs of length 1 

10 runs of length 2 

54 sectors differ 

 54 zero filled and 0 varying non-zero filled 

Settings: fill none size cd 

Write Block: fastbloc FE 9 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

AM-09 Error logged. as expected 

AM-10 Benign fill replaces inaccessible sectors. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 47 of 114 Test Results for EnCase 5.05f June 2008
5.2.21 DA-09-02 

Test Case DA-09-02 EnCase 5.05f 

Case 

Summary: 

DA-09 Acquire a digital source that has at least one faulty data sector. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file on 

file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AM-09 If unresolved errors occur while reading from the selected digital 

source, the tool notifies the user of the error type and location within the 

digital source. 

AM-10 If unresolved errors occur while reading from the selected digital 

source, the tool uses a benign fill in the destination object in place of 

the inaccessible data. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, the 

digital source is unchanged by the acquisition process. 

Tester 

Name: 

mrmw 

Test Host: Joe 

Test Date: Fri May 18 10:22:33 2007 

Drives: src(CPR1) dst (21) other (01-fu) 

Source 

Setup: 

No before hash for CPR1 120103200 total sectors (61492838400 bytes) 

 Drive with known bad sectors 

 Vendor: Maxtor Model: DiamondMax Plus 9 

Known Bad Sector List for ED-CPR-BAD-1 

Manufacturer: Maxtor 

Model: 6Y060L0 DiamondMax Plus 9 

Serial Number: Y27KR6CE 

Capacity: 60GB 

Interface: PATA 

54 faulty sectors 

10069095, 10069911, 12023808, 18652594, 18656041, 18656857, 18660303, 

18661119, 19746716-19746717, 22233904, 23098370, 23383001, 24102466-

24102467, 24104250, 24106656, 24107458, 28959971-28959972, 41825791, 

41828995, 52654580, 52655318, 60522984, 68643842-68643843, 69973290, 

72714626, 72715293, 82148809, 82148810, 83810525, 85310861, 85313430, 

85314038-85314039, 86321211, 86323780, 87186066, 87856313, 87856922, 

97191260-97191261, 100093150-100093151, 103861021, 109706975-109706976, 

110347947, 110350122-110350123, 115664758, 115835518 

Log 

Highlights: 

Destination setup 

312581808 sectors wiped with 52 

 

Comparision of original to clone Drive 

Sectors compared: 120103200 

Sectors match: 120103106 

Sectors differ: 94 

Bytes differ: 48034 

Diffs range 10069094-10069095, 10069910-10069911, 12023808-12023809, 

18652594-18652595, 18656040-18656041, 18656856-18656857, 

18660302-18660303, 18661118-18661119, 19746716-19746717, 

22233904-22233905, 23098370-23098371, 23383000-23383001, 

24102466-24102467, 24104250-24104251, 24106656-24106657, 

August 2008 48 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-09-02 EnCase 5.05f 

24107458-24107459, 28959970-28959973, 41825790-41825791, 

41828994-41828995, 52654580-52654581, 52655318-52655319, 

60522984-60522985, 68643842-68643843, 69973290-69973291, 

72714626-72714627, 72715292-72715293, 82148808-82148811, 

83810524-83810525, 85310860-85310861, 85313430-85313431, 

85314038-85314039, 86321210-86321211, 86323780-86323781, 

87186066-87186067, 87856312-87856313, 87856922-87856923, 

97191260-97191261, 100093150-100093151, 103861020-103861021, 

109706974-109706977, 110347946-110347947, 110350122-110350123, 

115664758-115664759, 115835518-115835519 

Source (120103200) has 75709872 fewer sectors than destination (195813072) 

Zero fill: 0 

Src Byte fill (ED): 0 

Dst Byte fill (21): 75709872 

Other fill: 0 

Other no fill: 0 

Zero fill range: 

Src fill range: 

Dst fill range: 120103200-195813071 

Other fill range: 

Other not filled range: 

0 source read errors, 0 destination read errors 

 

Actual Date:05/18/07 03:01:15PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:f6d2f0da8220ec8e147e5c9345836f95 

Verify Hash:f6d2f0da8220ec8e147e5c9345836f95 

EnCase Version:5.05f 

System Version:Windows 2000 

Error Granularity:2 

Read Errors:44 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:61,492,838,400 bytes (57.3GB) 

Total Sectors:120,103,200 

Read Errors: 44 

Missing Sector Errors: 0 

CRC Errors: 0 

Compression: Good 

Read Errors 

 Start Sector Sectors 

10,069,094 2 

10,069,910 2 

12,023,808 2 

18,652,594 2 

18,656,040 2 

18,656,856 2 

18,660,302 2 

18,661,118 2 

19,746,716 2 

22,233,904 2 

23,098,370 2 

23,383,000 2 

24,102,466 2 

24,104,250 2 

24,106,656 2 

24,107,458 2 

28,959,970 4 

41,825,790 2 

41,828,994 2 

52,654,580 2 

52,655,318 2 

60,522,984 2 

68,643,842 2 

69,973,290 2 

72,714,626 2 

72,715,292 2 

82,148,808 4 

83,810,524 2 

85,310,860 2 

August 2008 49 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-09-02 EnCase 5.05f 

85,313,430 2 

85,314,038 2 

86,321,210 2 

86,323,780 2 

87,186,066 2 

87,856,312 2 

87,856,922 2 

97,191,260 2 

100,093,150 2 

103,861,020 2 

109,706,974 4 

110,347,946 2 

110,350,122 2 

115,664,758 2 

115,835,518 2 

2 different run lengths observed in 44 runs 

41 runs of length 2 

3 runs of length 4 

94 sectors differ 

 94 zero filled and 0 varying non-zero filled 

Settings: fill none size cd 

Write Block: none 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. some sectors differ 

AM-09 Error logged. as expected 

AM-10 Benign fill replaces inaccessible sectors. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results not achieved 

August 2008 50 of 114 Test Results for EnCase 5.05f June 2008
5.2.22 DA-09-16 

Test Case DA-09-16 EnCase 5.05f 

Case 

Summary: 

DA-09 Acquire a digital source that has at least one faulty data sector. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file on 

file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AM-09 If unresolved errors occur while reading from the selected digital 

source, the tool notifies the user of the error type and location within the 

digital source. 

AM-10 If unresolved errors occur while reading from the selected digital 

source, the tool uses a benign fill in the destination object in place of 

the inaccessible data. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, the 

digital source is unchanged by the acquisition process. 

Tester 

Name: 

mrmw 

Test Host: Joe 

Test Date: Fri May 18 09:11:03 2007 

Drives: src(CPR1) dst (52) other (02-fu) 

Source 

Setup: 

No before hash for CPR1 120103200 total sectors (61492838400 bytes) 

 Drive with known bad sectors 

 Vendor: Maxtor Model: DiamondMax Plus 9 

Known Bad Sector List for ED-CPR-BAD-1 

Manufacturer: Maxtor 

Model: 6Y060L0 DiamondMax Plus 9 

Serial Number: Y27KR6CE 

Capacity: 60GB 

Interface: PATA 

54 faulty sectors 

10069095, 10069911, 12023808, 18652594, 18656041, 18656857, 18660303, 

18661119, 19746716-19746717, 22233904, 23098370, 23383001, 24102466-

24102467, 24104250, 24106656, 24107458, 28959971-28959972, 41825791, 

41828995, 52654580, 52655318, 60522984, 68643842-68643843, 69973290, 

72714626, 72715293, 82148809, 82148810, 83810525, 85310861, 85313430, 

85314038-85314039, 86321211, 86323780, 87186066, 87856313, 87856922, 

97191260-97191261, 100093150-100093151, 103861021, 109706975-109706976, 

110347947, 110350122-110350123, 115664758, 115835518 

Log 

Highlights: 

Destination setup 

312581808 sectors wiped with 52 

 

Comparision of original to clone Drive 

Sectors compared: 120103200 

Sectors match: 120102480 

Sectors differ: 720 

Bytes differ: 367920 

Diffs range 10069088-10069103, 10069904-10069919, 12023808-12023823, 

18652592-18652607, 18656032-18656047, 18656848-18656863, 

18660288-18660303, 18661104-18661119, 19746704-19746719, 

22233904-22233919, 23098368-23098383, 23382992-23383007, 

24102464-24102479, 24104240-24104255, 24106656-24106671, 

August 2008 51 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-09-16 EnCase 5.05f 

24107456-24107471, 28959968-28959983, 41825776-41825791, 

41828992-41829007, 52654576-52654591, 52655312-52655327, 

60522976-60522991, 68643840-68643855, 69973280-69973295, 

72714624-72714639, 72715280-72715295, 82148800-82148815, 

83810512-83810527, 85310848-85310863, 85313424-85313439, 

85314032-85314047, 86321200-86321215, 86323776-86323791, 

87186064-87186079, 87856304-87856319, 87856912-87856927, 

97191248-97191263, 100093136-100093151, 103861008-103861023, 

109706960-109706991, 110347936-110347951, 110350112-110350127, 

115664752-115664767, 115835504-115835519 

Source (120103200) has 192478608 fewer sectors than destination (312581808) 

Zero fill: 0 

Src Byte fill (ED): 0 

Dst Byte fill (52): 192478608 

Other fill: 0 

Other no fill: 0 

Zero fill range: 

Src fill range: 

Dst fill range: 120103200-312581807 

Other fill range: 

Other not filled range: 

0 source read errors, 0 destination read errors 

 

Start: 05/18/07 10:29:11AM 

Acquisition Hash: 474E17967F4D9CCC5A643A21F4907F17 

Actual Date:05/18/07 10:29:11AM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:474e17967f4d9ccc5a643a21f4907f17 

Verify Hash:474e17967f4d9ccc5a643a21f4907f17 

EnCase Version:5.05f 

System Version:Windows 2003 Server 

Error Granularity:16 

Read Errors:44 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:61,492,838,400 bytes (57.3GB) 

Total Sectors:120,103,200 

Read Errors: 44 

Missing Sector Errors: 0 

CRC Errors: 0 

Compression: Good 

Read Errors 

 Start Sector Sectors 

10,069,088 16 

10,069,904 16 

12,023,808 16 

18,652,592 16 

18,656,032 16 

18,656,848 16 

18,660,288 16 

18,661,104 16 

19,746,704 16 

22,233,904 16 

23,098,368 16 

23,382,992 16 

24,102,464 16 

24,104,240 16 

24,106,656 16 

24,107,456 16 

28,959,968 16 

41,825,776 16 

41,828,992 16 

52,654,576 16 

52,655,312 16 

60,522,976 16 

68,643,840 16 

69,973,280 16 

72,714,624 16 

72,715,280 16 

82,148,800 16 

August 2008 52 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-09-16 EnCase 5.05f 

83,810,512 16 

85,310,848 16 

85,313,424 16 

85,314,032 16 

86,321,200 16 

86,323,776 16 

87,186,064 16 

87,856,304 16 

87,856,912 16 

97,191,248 16 

100,093,136 16 

103,861,008 16 

109,706,960 32 

110,347,936 16 

110,350,112 16 

115,664,752 16 

115,835,504 16 

2 different run lengths observed in 44 runs 

43 runs of length 16 

1 runs of length 32 

720 sectors differ 

 720 zero filled and 0 varying non-zero filled 

Settings: fill none size cd 

Write Block: 37 WiebeTech ComboDock 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. some sectors differ 

AM-09 Error logged. as expected 

AM-10 Benign fill replaces inaccessible sectors. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results not achieved 

August 2008 53 of 114 Test Results for EnCase 5.05f June 2008
5.2.23 DA-09-64 

Test Case DA-09-64 EnCase 5.05f 

Case 

Summary: 

DA-09 Acquire a digital source that has at least one faulty data sector. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file on 

file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AM-09 If unresolved errors occur while reading from the selected digital 

source, the tool notifies the user of the error type and location within the 

digital source. 

AM-10 If unresolved errors occur while reading from the selected digital 

source, the tool uses a benign fill in the destination object in place of 

the inaccessible data. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, the 

digital source is unchanged by the acquisition process. 

Tester 

Name: 

mrmw 

Test Host: Frank 

Test Date: Mon May 21 12:12:37 2007 

Drives: src(CPR1) dst (21) other (01-fu) 

Source 

Setup: 

No before hash for CPR1 120103200 total sectors (61492838400 bytes) 

 Drive with known bad sectors 

 Vendor: Maxtor Model: DiamondMax Plus 9 

Known Bad Sector List for ED-CPR-BAD-1 

Manufacturer: Maxtor 

Model: 6Y060L0 DiamondMax Plus 9 

Serial Number: Y27KR6CE 

Capacity: 60GB 

Interface: PATA 

54 faulty sectors 

10069095, 10069911, 12023808, 18652594, 18656041, 18656857, 18660303, 

18661119, 19746716-19746717, 22233904, 23098370, 23383001, 24102466-

24102467, 24104250, 24106656, 24107458, 28959971-28959972, 41825791, 

41828995, 52654580, 52655318, 60522984, 68643842-68643843, 69973290, 

72714626, 72715293, 82148809, 82148810, 83810525, 85310861, 85313430, 

85314038-85314039, 86321211, 86323780, 87186066, 87856313, 87856922, 

97191260-97191261, 100093150-100093151, 103861021, 109706975-109706976, 

110347947, 110350122-110350123, 115664758, 115835518 

Log 

Highlights: 

Destination setup 

195813072 sectors wiped with 21 

 

Comparision of original to clone Drive 

Sectors compared: 120103200 

Sectors match: 120101737 

Sectors differ: 1463 

Bytes differ: 51303 

Diffs range 10069095-10069119, 10069911-10069951, 12023808-12023871, 

18652594-18652607, 18656041-18656063, 18656857-18656895, 

18660303-18660351, 18661119, 19746716-19746751, 22233904-22233919, 

23098370-23098431, 23383001-23383039, 24102466-24102527, 

24104250-24104255, 24106656-24106687, 24107458-24107519, 

August 2008 54 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-09-64 EnCase 5.05f 

28959971-28959999, 41825791, 41828995-41829055, 52654580-52654591, 

52655318-52655359, 60522984-60523007, 68643842-68643903, 

69973290-69973311, 72714626-72714687, 72715293-72715327, 

82148809-82148863, 83810525-83810559, 85310861-85310911, 

85313430-85313471, 85314038-85314047, 86321211-86321215, 

86323780-86323839, 87186066-87186111, 87856313-87856319, 

87856922-87856959, 97191260-97191295, 100093150-100093183, 

103861021-103861055, 109706975-109707007, 110347947-110347967, 

110350122-110350143, 115664758-115664767, 115835518-115835519 

Source (120103200) has 75709872 fewer sectors than destination (195813072) 

Zero fill: 0 

Src Byte fill (ED): 0 

Dst Byte fill (21): 75709872 

Other fill: 0 

Other no fill: 0 

Zero fill range: 

Src fill range: 

Dst fill range: 120103200-195813071 

Other fill range: 

Other not filled range: 

0 source read errors, 0 destination read errors 

 

Start: 05/21/07 07:05:05PM 

Acquisition Hash: EAB64F53A8A4F45E51570D1B9787B9FC 

Start: 05/21/07 07:38:09PM 

Total Sectors: 195,813,072 

Input Hash: EAB64F53A8A4F45E51570D1B9787B9FC 

Actual Date:05/21/07 07:05:05PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:eab64f53a8a4f45e51570d1b9787b9fc 

Verify Hash:eab64f53a8a4f45e51570d1b9787b9fc 

EnCase Version:5.05f 

System Version:Windows XP 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:61,492,838,400 bytes (57.3GB) 

Total Sectors:120,103,200 

Read Errors: 0 

Missing Sector Errors: 0 

CRC Errors: 0 

Compression: Good 

-2100 Total Size: 61,492,838,400 bytes (57.3GB) 

Total Sectors: 120,103,200 

32 different run lengths observed in 44 runs 

2 runs of length 1 

1 runs of length 2 

1 runs of length 5 

1 runs of length 6 

1 runs of length 7 

2 runs of length 10 

1 runs of length 12 

1 runs of length 14 

1 runs of length 16 

1 runs of length 21 

2 runs of length 22 

1 runs of length 23 

1 runs of length 24 

1 runs of length 25 

1 runs of length 29 

1 runs of length 32 

1 runs of length 33 

1 runs of length 34 

3 runs of length 35 

2 runs of length 36 

1 runs of length 38 

2 runs of length 39 

1 runs of length 41 

August 2008 55 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-09-64 EnCase 5.05f 

2 runs of length 42 

1 runs of length 46 

1 runs of length 49 

1 runs of length 51 

1 runs of length 55 

1 runs of length 60 

1 runs of length 61 

5 runs of length 62 

1 runs of length 64 

1463 sectors differ 

 0 zero filled and 1463 varying non-zero filled 

Settings: fill none size FAT(2000MB) 

Write Block: Fastbloc SE 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type 

FS. 

as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. some sectors differ 

AM-09 Error logged. faulty sector not 

logged 

AM-10 Benign fill replaces inaccessible 

sectors. 

undetermined fill 

source 

AO-01 Image file is complete and accurate. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results not achieved 

August 2008 56 of 114 Test Results for EnCase 5.05f June 2008
5.2.24 DA-10-BEST 

Test Case DA-10-BEST EnCase 5.05f 

Case 

Summary: 

DA-10 Acquire a digital source to an image file in an alternate format. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file 

on file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-02 If an image file format is specified, the tool creates an image file 

in the specified format. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, 

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 

Test Host: Joe 

Test Date: Tue Feb 22 11:34:07 2007 

Drives: src(43) dst (2) other (01-fu) 

Source 

Setup: 

src hash (SHA1): < 888E2E7F7AD237DC7A732281DD93F325065E5871 > 

src hash (MD5): < BC39C3F7EE7A50E77B9BA1E65A5AEEF7 > 

78125000 total sectors (40000000000 bytes) 

Model (0BB-75JHC0 ) serial # ( WD-WMAMC46588) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057143205 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027712125 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027712062 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027712062 sectors 14188575744 bytes 

Log 

Highlights: 

Start: 05/22/07 12:39:31PM 

Acquisition Hash: BC39C3F7EE7A50E77B9BA1E65A5AEEF7 

Settings: fill none size cd 

Write Block: fastbloc LE 42 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

August 2008 57 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-10-BEST EnCase 5.05f 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-02 Image file in specified format. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 58 of 114 Test Results for EnCase 5.05f June 2008
5.2.25 DA-10-PASSWORD 

Test Case DA-10-PASSWORD EnCase 5.05f 

Case 

Summary: 

DA-10 Acquire a digital source to an image file in an alternate format. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file 

on file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-02 If an image file format is specified, the tool creates an image file 

in the specified format. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, 

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 

Test Host: Frank 

Test Date: Thu May 17 12:49:12 2007 

Drives: src(43) dst (55-IDE) other (01-FU) 

Source 

Setup: 

src hash (SHA1): < 888E2E7F7AD237DC7A732281DD93F325065E5871 > 

src hash (MD5): < BC39C3F7EE7A50E77B9BA1E65A5AEEF7 > 

78125000 total sectors (40000000000 bytes) 

Model (0BB-75JHC0 ) serial # ( WD-WMAMC46588) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057143205 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027712125 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027712062 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027712062 sectors 14188575744 bytes 

Log 

Highlights: 

Start: 05/21/07 01:29:06PM 

Acquisition Hash: BC39C3F7EE7A50E77B9BA1E65A5AEEF7 

Start: 05/21/07 01:58:51PM 

Start Sector: 63 

Stop Sector: 20,980,889 

Start: 05/21/07 02:00:55PM 

Start Sector: 20,980,953 

Stop Sector: 21,013,019 

August 2008 59 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-10-PASSWORD EnCase 5.05f 

Start: 05/21/07 02:01:17PM 

Start Sector: 20,980,953 

Stop Sector: 21,013,019 

Start: 05/21/07 02:01:27PM 

Start Sector: 21,013,083 

Stop Sector: 23,117,534 

Start: 05/21/07 02:01:50PM 

Start Sector: 23,117,598 

Stop Sector: 27,310,499 

Start: 05/21/07 02:02:29PM 

Start Sector: 27,310,563 

Stop Sector: 35,712,494 

Start: 05/21/07 02:03:14PM 

Start Sector: 35,712,558 

Stop Sector: 46,202,939 

Start: 05/21/07 02:04:08PM 

Start Sector: 46,203,003 

Stop Sector: 50,411,969 

Start: 05/21/07 02:04:35PM 

Start Sector: 50,412,033 

Stop Sector: 78,124,094 

Start: 05/21/07 02:07:48PM 

Total Sectors: 390,721,968 

Actual Date:05/21/07 01:29:06PM 

File Integrity:Completely Verified, 0 Errors 

Verify Hash:bc39c3f7ee7a50e77b9ba1e65a5aeef7 

EnCase Version:5.05f 

System Version:Windows XP 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:40,000,000,000 bytes (37.3GB) 

Total Sectors:78,125,000 

Settings: fill none size cd 

Write Block: Tableau 6 FW800 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-02 Image file in specified format. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 60 of 114 Test Results for EnCase 5.05f June 2008
5.2.26 DA-10-UNCOMPRESSED 

Test Case DA-10-UNCOMPRESSED EnCase 5.05f 

Case 

Summary: 

DA-10 Acquire a digital source to an image file in an alternate format. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file 

on file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-02 If an image file format is specified, the tool creates an image file 

in the specified format. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, 

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 

Test Host: Joe 

Test Date: Tue May 22 14:41:53 2007 

Drives: src(43) dst (29) other (01-fu) 

Source 

Setup: 

src hash (SHA1): < 888E2E7F7AD237DC7A732281DD93F325065E5871 > 

src hash (MD5): < BC39C3F7EE7A50E77B9BA1E65A5AEEF7 > 

78125000 total sectors (40000000000 bytes) 

Model (0BB-75JHC0 ) serial # ( WD-WMAMC46588) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057143205 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027712125 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027712062 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027712062 sectors 14188575744 bytes 

Log 

Highlights: 

Actual Date:05/23/07 07:33:27AM 

Acquisition Hash:bc39c3f7ee7a50e77b9ba1e65a5aeef7 

EnCase Version:5.05f 

System Version:Windows 2003 Server 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

August 2008 61 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-10-UNCOMPRESSED EnCase 5.05f 

Total Size:40,000,000,000 bytes (37.3GB) 

Total Sectors:78,125,000 

Settings: fill none size cd 

Write Block: Fastbloc FE 45 FW800 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-02 Image file in specified format. as expected 

AO-05 Multifile image created. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 62 of 114 Test Results for EnCase 5.05f June 2008
5.2.27 DA-12 

Test Case DA-12 EnCase 5.05f 

Case 

Summary: 

DA-12 Attempt to create an image file where there is insufficient space. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file on 

file system type FS. 

AO-04 If the tool is creating an image file and there is insufficient space 

on the image destination device to contain the image file, the tool shall 

notify the user. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, the 

digital source is unchanged by the acquisition process. 

Tester 

Name: 

mrmw 

Test Host: Frank 

Test Date: Wed Jun 13 10:00:48 2007 

Drives: src(2A) dst (none) other (none) 

Source 

Setup: 

src hash (SHA256): < 

AE8E839101661367D92803D5F5D408268635EFD8A05FEA633838CDC3919F5ABA > 

src hash (SHA1): < F5F9F2903DCAB895F36E270FB22A722E27918125 > 

src hash (MD5): < 91E0AC905F682ECF6DE4E9835089B519 > 

17783249 total sectors (9105023488 bytes) 

Model (QM39100TD-SCA ) serial # (PCB=20-116711-06 HDAQM39100TD-SCA ) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 017751762 0000/001/01 1023/254/63 Boot 07 NTFS 

 2 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 3 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 4 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 017751762 sectors 9088902144 bytes 

Log 

Highlights: 

Start: 06/13/07 10:01:22AM 

Acquisition Hash: B5A01F014AF64F00756177CAD76486B5 

Actual Date:06/13/07 10:00:30AM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:b5a01f014af64f00756177cad76486b5 

Verify Hash:069b35ebfbb4e5a4e79b8f6e6cfbb4b2 

EnCase Version:5.05f 

System Version:Windows XP 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:1 

CRC Errors:0 

Total Size:9,105,023,488 bytes (8.5GB) 

Total Sectors:17,783,249 

Settings: fill none 

Write Block: FastBloc SE 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AO-04 User notified if space exhausted. as expected 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 63 of 114 Test Results for EnCase 5.05f June 2008
5.2.28 DA-13 

Test Case DA-13 EnCase 5.05f 

Case 

Summary: 

DA-13 Create an image file where there is insufficient space on a single 

volume, and use destination device switching to continue on another volume. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. 

AM-02 The tool acquires digital source DS. 

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file on 

file system type FS. 

AM-06 All visible sectors are acquired from the digital source. 

AM-08 All sectors acquired from the digital source are acquired accurately. 

AO-01 If the tool creates an image file, the data represented by the image 

file is the same as the data acquired by the tool. 

AO-04 If the tool is creating an image file and there is insufficient space 

on the image destination device to contain the image file, the tool shall 

notify the user. 

AO-05 If the tool creates a multi-file image of a requested size then all 

the individual files shall be no larger than the requested size. 

AO-10 If there is insufficient space to contain all files of a multi-file 

image and if destination device switching is supported, the image is 

continued on another device. 

AO-22 If requested, the tool calculates block hashes for a specified block 

size during an acquisition for each block acquired from the digital source. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

AO-24 If the tool executes in a forensically safe execution environment, the 

digital source is unchanged by the acquisition process. 

Tester 

Name: 

mrmw 

Test Host: Frank 

Test Date: Wed Jun 13 10:21:48 2007 

Drives: src(2A) dst (none) other (none) 

Source 

Setup: 

src hash (SHA256): < 

AE8E839101661367D92803D5F5D408268635EFD8A05FEA633838CDC3919F5ABA > 

src hash (SHA1): < F5F9F2903DCAB895F36E270FB22A722E27918125 > 

src hash (MD5): < 91E0AC905F682ECF6DE4E9835089B519 > 

17783249 total sectors (9105023488 bytes) 

Model (QM39100TD-SCA ) serial # (PCB=20-116711-06 HDAQM39100TD-SCA ) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 017751762 0000/001/01 1023/254/63 Boot 07 NTFS 

 2 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 3 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 4 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 017751762 sectors 9088902144 bytes 

Log 

Highlights: 

Start: 06/13/07 11:31:53AM 

Start Sector: 0 

Stop Sector: 17,783,248 

Hash Value: 91E0AC905F682ECF6DE4E9835089B519 

Actual Date:06/13/07 10:26:15AM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:91e0ac905f682ecf6de4e9835089b519 

Verify Hash:91e0ac905f682ecf6de4e9835089b519 

EnCase Version:5.05f 

System Version:Windows XP 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:9,105,023,488 bytes (8.5GB) 

Total Sectors:17,783,249 

Actual Date:06/13/07 10:26:15AM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:91e0ac905f682ecf6de4e9835089b519 

Verify Hash:91e0ac905f682ecf6de4e9835089b519 

EnCase Version:5.05f 

System Version:Windows XP 

August 2008 64 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-13 EnCase 5.05f 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:9,105,023,488 bytes (8.5GB) 

Total Sectors:17,783,249 

Start: 06/13/07 11:34:19AM 

Start Sector: 0 

Stop Sector: 17,783,248 

Hash Value: 91E0AC905F682ECF6DE4E9835089B519 

Settings: fill none 

Write Block: FastBloc SE 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected 

AM-02 Source is type DS. as expected 

AM-03 Execution environment is XE. as expected 

AM-05 An image is created on file system type FS. as expected 

AM-06 All visible sectors acquired. as expected 

AM-08 All sectors accurately acquired. as expected 

AO-01 Image file is complete and accurate. as expected 

AO-04 User notified if space exhausted. as expected 

AO-05 Multifile image created. as expected 

AO-10 Image file continued on new device. as expected 

AO-22 Tool calculates hashes by block. option not available 

AO-23 Logged information is correct. as expected 

AO-24 Source is unchanged by acquisition. not checked 

 

Analysis: Expected results achieved 

August 2008 65 of 114 Test Results for EnCase 5.05f June 2008
5.2.29 DA-14-ATA28 

Test Case DA-14-ATA28 EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are 

not modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester Name: slm 

Test Host: joe 

Test Date: Tue Apr 17 11:14:46 2007 

Drives: src(43) dst (7c) other (fat32) 

Source 

Setup: 

src hash (SHA1): < 888E2E7F7AD237DC7A732281DD93F325065E5871 > 

src hash (MD5): < BC39C3F7EE7A50E77B9BA1E65A5AEEF7 > 

78125000 total sectors (40000000000 bytes) 

Model (0BB-75JHC0 ) serial # ( WD-WMAMC46588) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057143205 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027712125 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027712062 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027712062 sectors 14188575744 bytes 

Log 

Highlights: 

Destination setup 

78177792 sectors wiped with 7C 

 

Comparision of original to clone Drive 

Sectors compared: 78125000 

Sectors match: 78125000 

Sectors differ: 0 

Bytes differ: 0 

Diffs range 

Source (78125000) has 52792 fewer sectors than destination (78177792) 

Zero fill: 0 

Src Byte fill (43): 0 

Dst Byte fill (7C): 52792 

Other fill: 0 

Other no fill: 0 

Zero fill range: 

August 2008 66 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-14-ATA28 EnCase 5.05f 

Src fill range: 

Dst fill range: 78125000-78177791 

Other fill range: 

Other not filled range: 

0 source read errors, 0 destination read errors 

 

Start: 04/18/07 03:27:44PM 

Total Sectors: 78,177,792 

Input Hash: BC39C3F7EE7A50E77B9BA1E65A5AEEF7 

Settings: fill none 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. as expected 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results achieved 

August 2008 67 of 114 Test Results for EnCase 5.05f June 2008
5.2.30 DA-14-ATA48 

Test Case DA-14-ATA48 EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are 

not modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester Name: slm 

Test Host: joe 

Test Date: Thu Apr 12 12:07:10 2007 

Drives: src(4C) dst (2a-ide) other (fat) 

Source 

Setup: 

src hash (SHA1): < 8FF620D2BEDCCAFE8412EDAAD56C8554F872EFBF > 

src hash (MD5): < D10F763B56D4CEBA2D1311C61F9FB382 > 

390721968 total sectors (200049647616 bytes) 

24320/254/63 (max cyl/hd values) 

24321/255/63 (number of cyl/hd) 

IDE disk: Model (WDC WD2000JB-00KFA0) serial # (WD-WMAMR1031111) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 390700737 0000/001/01 1023/254/63 Boot 07 NTFS 

 2 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 3 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 4 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 390700737 sectors 200038777344 bytes 

Log 

Highlights: 

Destination setup 

490234752 sectors wiped with 2A 

 

Comparision of original to clone Drive 

Sectors compared: 390721968 

Sectors match: 390721968 

Sectors differ: 0 

Bytes differ: 0 

Diffs range 

Source (390721968) has 99512784 fewer sectors than destination (490234752) 

Zero fill: 0 

Src Byte fill (4C): 0 

Dst Byte fill (2A): 99512784 

Other fill: 0 

Other no fill: 0 

Zero fill range: 

Src fill range: 

Dst fill range: 390721968-490234751 

Other fill range: 

Other not filled range: 

0 source read errors, 0 destination read errors 

 

Start: 04/12/07 12:21:29PM 

Total Sectors: 490,234,752 

Input Hash: D10F763B56D4CEBA2D1311C61F9FB382 

Actual Date:04/03/07 03:50:36PM 

Acquisition Hash:d10f763b56d4ceba2d1311c61f9fb382 

EnCase Version:5.05f 

System Version:Windows 2003 Server 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:200,049,647,616 bytes (186.3GB) 

Total Sectors:390,721,968 

August 2008 68 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-14-ATA48 EnCase 5.05f 

Settings: fill none 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. as expected 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results achieved 

August 2008 69 of 114 Test Results for EnCase 5.05f June 2008
5.2.31 DA-14-BEST 

Test Case DA-14-BEST EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are 

not modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester Name: mrmw 

Test Host: Freddy 

Test Date: Fri Nov 30 15:59:45 2007 

Drives: src(43) dst (7B) other (06-FU) 

Source 

Setup: 

src hash (SHA1): < 888E2E7F7AD237DC7A732281DD93F325065E5871 > 

src hash (MD5): < BC39C3F7EE7A50E77B9BA1E65A5AEEF7 > 

78125000 total sectors (40000000000 bytes) 

Model (0BB-75JHC0 ) serial # ( WD-WMAMC46588) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057143205 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027712125 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027712062 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027712062 sectors 14188575744 bytes 

Log 

Highlights: 

Destination setup 

78177792 sectors wiped with 7B 

 

Comparision of original to clone Drive 

Sectors compared: 78125000 

Sectors match: 78125000 

Sectors differ: 0 

Bytes differ: 0 

Diffs range 

Source (78125000) has 52792 fewer sectors than destination (78177792) 

Zero fill: 0 

Src Byte fill (43): 0 

Dst Byte fill (7B): 52792 

Other fill: 0 

Other no fill: 0 

Zero fill range: 

August 2008 70 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-14-BEST EnCase 5.05f 

Src fill range: 

Dst fill range: 78125000-78177791 

Other fill range: 

Other not filled range: 

0 source read errors, 0 destination read errors 

 

Start: 11/30/07 05:24:05PM 

Total Sectors: 78,177,792 

Input Hash: BC39C3F7EE7A50E77B9BA1E65A5AEEF7 

Actual Date:11/30/07 02:49:32PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:bc39c3f7ee7a50e77b9ba1e65a5aeef7 

Verify Hash:bc39c3f7ee7a50e77b9ba1e65a5aeef7 

EnCase Version:5.05f 

System Version:Windows XP 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:40,000,000,000 bytes (37.3GB) 

Total Sectors:78,125,000 

Settings: fill none 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. as expected 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results achieved 

August 2008 71 of 114 Test Results for EnCase 5.05f June 2008
5.2.32 DA-14-CF 

Test Case DA-14-CF EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the clone 

device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are not 

modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester 

Name: 

mrmw 

Test Host: Frank 

Test Date: Fri Sep 14 11:06:13 2007 

Drives: src(C1-CF) dst (C2-CF) other (01-FU) 

Source 

Setup: 

src hash (SHA256): < 

C7CF0218222DF80D5316511D6814266C7FA507C13F795AD3D323BB73C1590D80 > 

src hash (SHA1): < 5B8235178DF99FA307430C088F81746606638A0B > 

src hash (MD5): < 776DF8B4D2589E21DEBCF589EDC16D78 > 

503808 total sectors (257949696 bytes) 

Model ( CF) serial # () 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 778135908 1141509631 0357/116/40 0357/032/45 Boot 72 other 

 2 P 168689522 1936028240 0288/115/43 0367/114/50 Boot 65 other 

 3 P 1869881465 1936028192 0366/032/33 0357/032/43 Boot 79 other 

 4 P 2885681152 000055499 0372/097/50 0000/010/00 Boot 0D other 

1 1141509631 sectors 584452931072 bytes 

2 1936028240 sectors 991246458880 bytes 

3 1936028192 sectors 991246434304 bytes 

4 000055499 sectors 28415488 bytes 

Log 

Highlights: 

Destination setup 

503808 sectors wiped with 2 

 

Comparision of original to clone Drive 

Sectors compared: 503808 

Sectors match: 503808 

Sectors differ: 0 

Bytes differ: 0 

Diffs range 

0 source read errors, 0 destination read errors 

 

Actual Date:09/14/07 01:59:26PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:776df8b4d2589e21debcf589edc16d78 

Verify Hash:776df8b4d2589e21debcf589edc16d78 

EnCase Version:5.05f 

System Version:Windows 2003 Server 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:257,949,696 bytes (246MB) 

Total Sectors:503,808 

Settings: size CD (640 MB) 

 fill none 

Write Block: 7 UltraBlock Forensci Card Reader 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

August 2008 72 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-14-CF EnCase 5.05f 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. as expected 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results achieved 

August 2008 73 of 114 Test Results for EnCase 5.05f June 2008
5.2.33 DA-14-F12 

Test Case DA-14-F12 EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are 

not modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester Name: mrmw 

Test Host: Frank 

Test Date: Thu Jun 21 09:33:44 2007 

Drives: src(01) dst (63) other (02-FU) 

Source 

Setup: 

src hash (SHA1): < A48BB5665D6DC57C22DB68E2F723DA9AA8DF82B9 > 

src hash (MD5): < F458F673894753FA6A0EC8B8EC63848E > 

78165360 total sectors (40020664320 bytes) 

Model (0BB-00JHC0 ) serial # ( WD-WMAMC74171) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057175335 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027744255 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027744192 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027744192 sectors 14205026304 bytes 

Log 

Highlights: 

Destination setup 

12594960 sectors wiped with 63 

Comparision of original to clone Partition 

Sectors compared: 32067 

Sectors match: 32067 

Sectors differ: 0 

Bytes differ: 0 

Diffs range: 

run start Thu Jun 21 16:16:11 2007 

run finish Thu Jun 21 16:16:19 2007 

elapsed time 0:0:8 

Normal exit 

Start: 06/21/07 01:15:49PM 

Total Sectors: 64,197 

Input Hash: E20E3CFEA80BF6F2D2AA75E829CC8CD9 

Start: 06/21/07 04:32:04PM 

August 2008 74 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-14-F12 EnCase 5.05f 

Start Sector: 0 

Stop Sector: 32,066 

Hash Value: E20E3CFEA80BF6F2D2AA75E829CC8CD9 

Total Capacity:16,384,000 bytes (15.6MB) 

Total Clusters:4,000Unallocated:16,248,832 bytes (15.5MB) 

OEM Version:MSWIN4.0Serial Number:8AC5-98DE 

Actual Date:06/20/07 03:01:39PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:e20e3cfea80bf6f2d2aa75e829cc8cd9 

Verify Hash:e20e3cfea80bf6f2d2aa75e829cc8cd9 

EnCase Version:5.05f 

System Version:Windows 2000 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:16,418,304 bytes (15.7MB) 

Total Sectors:32,067 

Settings: fill none 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. as expected 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results achieved 

August 2008 75 of 114 Test Results for EnCase 5.05f June 2008
5.2.34 DA-14-F16 

Test Case DA-14-F16 EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are 

not modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester Name: slm 

Test Host: joe 

Test Date: Mon Apr 23 14:37:44 2007 

Drives: src(43) dst (7c) other (-new_log) 

Source 

Setup: 

src hash (SHA1): < 888E2E7F7AD237DC7A732281DD93F325065E5871 > 

src hash (MD5): < BC39C3F7EE7A50E77B9BA1E65A5AEEF7 > 

78125000 total sectors (40000000000 bytes) 

Model (0BB-75JHC0 ) serial # ( WD-WMAMC46588) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057143205 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027712125 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027712062 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027712062 sectors 14188575744 bytes 

Log 

Highlights: 

Destination setup 

78177792 sectors wiped with 7C 

Comparision of original to clone Partition 

Sectors compared: 2104452 

Sectors match: 2104452 

Sectors differ: 0 

Bytes differ: 0 

Diffs range: 

Source (2104452) has 160650 fewer sectors than destination (2265102) 

Zero fill: 0 

Src Byte fill (43): 0 

Dst Byte fill (7C): 160650 

Other fill: 0 

Other no fill: 0 

Zero fill range: 

Src fill range: 

August 2008 76 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-14-F16 EnCase 5.05f 

Dst fill range: 2104452-2265101 

Other fill range: 

Other not filled range: 

run start Wed Apr 25 14:37:57 2007 

run finish Wed Apr 25 14:41:00 2007 

elapsed time 0:3:3 

Normal exit 

Start: 04/25/07 02:58:56PM 

Total Sectors: 2,265,102 

Input Hash: 37E81FFB31C3CB38AA48B2237500908E 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. as expected 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results achieved 

August 2008 77 of 114 Test Results for EnCase 5.05f June 2008
5.2.35 DA-14-F32 

Test Case DA-14-F32 EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are 

not modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester Name: slm 

Test Host: joe 

Test Date: Mon May 7 14:36:49 2007 

Drives: src(01-ide) dst (7e) other (ntfs) 

Source 

Setup: 

src hash (SHA1): < A48BB5665D6DC57C22DB68E2F723DA9AA8DF82B9 > 

src hash (MD5): < F458F673894753FA6A0EC8B8EC63848E > 

78165360 total sectors (40020664320 bytes) 

Model (0BB-00JHC0 ) serial # ( WD-WMAMC74171) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057175335 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027744255 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027744192 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027744192 sectors 14205026304 bytes 

Log 

Highlights: 

Destination setup 

78177792 sectors wiped with 7E 

Comparision of original to clone Partition 

Sectors compared: 8401932 

Sectors match: 8401929 

Sectors differ: 3 

Bytes differ: 3 

Diffs range: 1, 36, 8226 

run start Mon May 7 14:53:14 2007 

run finish Mon May 7 15:06:39 2007 

elapsed time 0:13:25 

Normal exit 

Start: 05/07/07 03:42:41PM 

Total Sectors: 8,401,932 

Input Hash: BFF7DC64C54339DA2A9D7972C076B514 

August 2008 78 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-14-F32 EnCase 5.05f 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. some sectors differ 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results not achieved 

August 2008 79 of 114 Test Results for EnCase 5.05f June 2008
5.2.36 DA-14-F32-ALT 

Test Case DA-14-F32-ALT EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are 

not modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester Name: slm 

Test Host: joe 

Test Date: Mon May 7 16:14:26 2007 

Drives: src(01-ide) dst (7e) other (ntfs) 

Source 

Setup: 

src hash (SHA1): < A48BB5665D6DC57C22DB68E2F723DA9AA8DF82B9 > 

src hash (MD5): < F458F673894753FA6A0EC8B8EC63848E > 

78165360 total sectors (40020664320 bytes) 

Model (0BB-00JHC0 ) serial # ( WD-WMAMC74171) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057175335 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027744255 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027744192 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027744192 sectors 14205026304 bytes 

Log 

Highlights: 

Destination setup 

78177792 sectors wiped with 7E 

Comparision of original to clone Partition 

Sectors compared: 8401932 

Sectors match: 8401932 

Sectors differ: 0 

Bytes differ: 0 

Diffs range: 

run start Tue May 8 13:51:30 2007 

run finish Tue May 8 14:22:25 2007 

elapsed time 0:30:55 

Normal exit 

Start: 05/08/07 12:37:51PM 

Total Sectors: 8,401,932 

Input Hash: BFF7DC64C54339DA2A9D7972C076B514 

August 2008 80 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-14-F32-ALT EnCase 5.05f 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. as expected 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results achieved 

August 2008 81 of 114 Test Results for EnCase 5.05f June 2008
5.2.37 DA-14-F32X 

Test Case DA-14-F32X EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are 

not modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester Name: slm 

Test Host: joe 

Test Date: Wed Apr 25 16:08:34 2007 

Drives: src(43) dst (7c) other (fat32) 

Source 

Setup: 

src hash (SHA1): < 888E2E7F7AD237DC7A732281DD93F325065E5871 > 

src hash (MD5): < BC39C3F7EE7A50E77B9BA1E65A5AEEF7 > 

78125000 total sectors (40000000000 bytes) 

Model (0BB-75JHC0 ) serial # ( WD-WMAMC46588) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057143205 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027712125 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027712062 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027712062 sectors 14188575744 bytes 

Log 

Highlights: 

Destination setup 

78177792 sectors wiped with 7C 

Comparision of original to clone Partition 

Sectors compared: 20980827 

Sectors match: 20980824 

Sectors differ: 3 

Bytes differ: 3 

Diffs range: 1, 32, 10268 

Source (20980827) has 1558305 fewer sectors than destination (22539132) 

Zero fill: 0 

Src Byte fill (43): 0 

Dst Byte fill (7C): 1558305 

Other fill: 0 

Other no fill: 0 

Zero fill range: 

Src fill range: 

August 2008 82 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-14-F32X EnCase 5.05f 

Dst fill range: 20980827-22539131 

Other fill range: 

Other not filled range: 

run start Thu Apr 26 15:13:48 2007 

run finish Thu Apr 26 15:46:43 2007 

elapsed time 0:32:55 

Normal exit 

Start: 04/26/07 03:55:36PM 

Total Sectors: 22,539,132 

Input Hash: 5980CB0FA68E9862C65765DF50F00906 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. some sectors differ 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results not achieved 

August 2008 83 of 114 Test Results for EnCase 5.05f June 2008
5.2.38 DA-14-F32X-ALT 

Test Case DA-14-F32X-ALT EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are 

not modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester Name: slm 

Test Host: joe 

Test Date: Fri Apr 27 10:26:04 2007 

Drives: src(43) dst (7c) other (fat32) 

Source 

Setup: 

src hash (SHA1): < 888E2E7F7AD237DC7A732281DD93F325065E5871 > 

src hash (MD5): < BC39C3F7EE7A50E77B9BA1E65A5AEEF7 > 

78125000 total sectors (40000000000 bytes) 

Model (0BB-75JHC0 ) serial # ( WD-WMAMC46588) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057143205 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027712125 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027712062 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027712062 sectors 14188575744 bytes 

Log 

Highlights: 

Destination setup 

78177792 sectors wiped with 7C 

Comparision of original to clone Partition 

Sectors compared: 20980827 

Sectors match: 20980827 

Sectors differ: 0 

Bytes differ: 0 

Diffs range: 

Source (20980827) has 1558305 fewer sectors than destination (22539132) 

Zero fill: 0 

Src Byte fill (43): 0 

Dst Byte fill (7C): 1558305 

Other fill: 0 

Other no fill: 0 

Zero fill range: 

Src fill range: 

August 2008 84 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-14-F32X-ALT EnCase 5.05f 

Dst fill range: 20980827-22539131 

Other fill range: 

Other not filled range: 

run start Fri Apr 27 10:31:31 2007 

run finish Fri Apr 27 11:03:56 2007 

elapsed time 0:32:25 

Normal exit 

Start: 04/27/07 11:03:14AM 

Total Sectors: 22,539,132 

Input Hash: 5980CB0FA68E9862C65765DF50F00906 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. as expected 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results achieved 

August 2008 85 of 114 Test Results for EnCase 5.05f June 2008
5.2.39 DA-14-FLOPPY 

Test Case DA-14-FLOPPY EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are 

not modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester Name: slm 

Test Host: joe 

Test Date: Thu Apr 19 17:27:40 2007 

Drives: src(floppy) dst (floppy) other (fat32) 

Source 

Setup: 

src hash (SHA1): < e2863334ac7eaabc7c8a0d62eb0d3b3af29f2c40 > 

src hash (MD5): < 17f6a5925be2f38eedaf435ff8b6a6f4 > 

Floppy disk 

Log 

Highlights: 

Destination setup 

2880 sectors wiped with 1 

 

Comparision of original to clone Drive 

 

Start: 04/19/07 06:36:50PM 

Total Sectors: 2,880 

Input Hash: 17F6A5925BE2F38EEDAF435FF8B6A6F4 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. as expected 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results achieved 

August 2008 86 of 114 Test Results for EnCase 5.05f June 2008
5.2.40 DA-14-FW 

Test Case DA-14-FW EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are 

not modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester Name: mrmw 

Test Host: Joe 

Test Date: Tue Dec 11 15:58:29 2007 

Drives: src(01-IDE) dst (7B) other (01-FU) 

Source 

Setup: 

src hash (SHA1): < A48BB5665D6DC57C22DB68E2F723DA9AA8DF82B9 > 

src hash (MD5): < F458F673894753FA6A0EC8B8EC63848E > 

78165360 total sectors (40020664320 bytes) 

Model (0BB-00JHC0 ) serial # ( WD-WMAMC74171) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057175335 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027744255 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027744192 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027744192 sectors 14205026304 bytes 

Log 

Highlights: 

Destination setup 

78177792 sectors wiped with 7B 

 

Comparision of original to clone Drive 

Sectors compared: 78165360 

Sectors match: 78165360 

Sectors differ: 0 

Bytes differ: 0 

Diffs range 

Source (78165360) has 12432 fewer sectors than destination (78177792) 

Zero fill: 0 

Src Byte fill (ED): 0 

Dst Byte fill (7B): 12432 

Other fill: 0 

Other no fill: 0 

Zero fill range: 

August 2008 87 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-14-FW EnCase 5.05f 

Src fill range: 

Dst fill range: 78165360-78177791 

Other fill range: 

Other not filled range: 

0 source read errors, 0 destination read errors 

 

Start: 12/11/07 05:15:28PM 

Total Sectors: 78,177,792 

Input Hash: F458F673894753FA6A0EC8B8EC63848E 

Actual Date:12/06/07 12:53:47PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:f458f673894753fa6a0ec8b8ec63848e 

Verify Hash:f458f673894753fa6a0ec8b8ec63848e 

EnCase Version:5.05f 

System Version:Windows XP 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:40,020,664,320 bytes (37.3GB) 

Total Sectors:78,165,360 

Settings: fill none 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. as expected 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results achieved 

August 2008 88 of 114 Test Results for EnCase 5.05f June 2008
5.2.41 DA-14-HOT 

Test Case DA-14-HOT EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the clone 

device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are not 

modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester 

Name: 

mrmw 

Test Host: Frank 

Test Date: Wed Jun 13 11:05:41 2007 

Drives: src(2A) dst (2E) other (01-FU and 01-FU) 

Source 

Setup: 

src hash (SHA256): < 

AE8E839101661367D92803D5F5D408268635EFD8A05FEA633838CDC3919F5ABA > 

src hash (SHA1): < F5F9F2903DCAB895F36E270FB22A722E27918125 > 

src hash (MD5): < 91E0AC905F682ECF6DE4E9835089B519 > 

17783249 total sectors (9105023488 bytes) 

Model (QM39100TD-SCA ) serial # (PCB=20-116711-06 HDAQM39100TD-SCA ) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 017751762 0000/001/01 1023/254/63 Boot 07 NTFS 

 2 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 3 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 4 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 017751762 sectors 9088902144 bytes 

Log 

Highlights: 

Destination setup 

17783249 sectors wiped with 2E 

 

Comparision of original to clone Drive 

Sectors compared: 17783249 

Sectors match: 17783249 

Sectors differ: 0 

Bytes differ: 0 

Diffs range 

0 source read errors, 0 destination read errors 

 

Actual Date:06/13/07 10:26:15AM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:91e0ac905f682ecf6de4e9835089b519 

Verify Hash:91e0ac905f682ecf6de4e9835089b519 

EnCase Version:5.05f 

System Version:Windows XP 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:9,105,023,488 bytes (8.5GB) 

Total Sectors:17,783,249 

Settings: fill none 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. as expected 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

August 2008 89 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-14-HOT EnCase 5.05f 

Analysis: Expected results achieved 

August 2008 90 of 114 Test Results for EnCase 5.05f June 2008
5.2.42 DA-14-NTFS 

Test Case DA-14-NTFS EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are 

not modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester Name: mrmw 

Test Host: Max 

Test Date: Tue Jul 3 07:19:08 2007 

Drives: src(01) dst (03) other (01-FU) 

Source 

Setup: 

src hash (SHA1): < A48BB5665D6DC57C22DB68E2F723DA9AA8DF82B9 > 

src hash (MD5): < F458F673894753FA6A0EC8B8EC63848E > 

78165360 total sectors (40020664320 bytes) 

Model (0BB-00JHC0 ) serial # ( WD-WMAMC74171) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057175335 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027744255 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027744192 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027744192 sectors 14205026304 bytes 

Excess destination partition sectors hash: 

CMD: /usr/bin/machash.csh da-14-ntfs Max mrmw /dev/sdb5 03 -before -winsize 

7102513152 -new_log 

SHA1 0 - 7102513151 = BFEBB2ACB8D7233BAFF31527F2D58D5301738656 

SHA1 7102513152 - 14205026303 = 9FFDA7EE0AAB3EC807035BEBF2EEE7CB6564DD74 

Log 

Highlights: 

Comparision of original to clone Partition 

Sectors compared: 27744192 

Sectors match: 27744152 

Sectors differ: 40 

Bytes differ: 4434 

Diffs range: 6160368-6160399, 27744184-27744191 

run start Tue Jul 3 11:28:38 2007 

run finish Tue Jul 3 11:54:46 2007 

elapsed time 0:26:8 

Normal exit 

Start: 07/03/07 10:44:07PM 

August 2008 91 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-14-NTFS EnCase 5.05f 

Total Sectors: 27,744,191 

Input Hash: 494A6ED8A827AD9B5403E0CC89379956 

Write Block: 44 FastBloc2 FE 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. some sectors differ 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results not achieved 

August 2008 92 of 114 Test Results for EnCase 5.05f June 2008
5.2.43 DA-14-NTFS-ALT 

Test Case DA-14-NTFS-ALT EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are 

not modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester Name: mrmw 

Test Host: Max 

Test Date: Tue Jul 3 07:22:01 2007 

Drives: src(01) dst (03) other (01-FU) 

Source 

Setup: 

src hash (SHA1): < A48BB5665D6DC57C22DB68E2F723DA9AA8DF82B9 > 

src hash (MD5): < F458F673894753FA6A0EC8B8EC63848E > 

78165360 total sectors (40020664320 bytes) 

Model (0BB-00JHC0 ) serial # ( WD-WMAMC74171) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057175335 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027744255 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027744192 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027744192 sectors 14205026304 bytes 

Excess destination partition sectors hash: 

CMD: /usr/bin/machash.csh da-14-ntfs-alt Max mrmw /dev/hdb6 03 -before -

winsize 7102513152 -new_log 

SHA1 0 - 7102513151 = 14FABA484DFB46EF7251C044E8822F99EDE1C3B1 

SHA1 7102513152 - 14205026303 = 7EB5317D6308FB2C86BE79E0582192459DB9137A 

Log 

Highlights: 

Comparision of original to clone Partition 

Sectors compared: 27744192 

Sectors match: 27744184 

Sectors differ: 8 

Bytes differ: 3501 

Diffs range: 27744184-27744191 

run start Tue Jul 3 09:47:23 2007 

run finish Tue Jul 3 10:13:35 2007 

elapsed time 0:26:12 

Normal exit 

Start: 07/03/07 09:23:45AM 

August 2008 93 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-14-NTFS-ALT EnCase 5.05f 

Total Sectors: 27,744,191 

Input Hash: 494A6ED8A827AD9B5403E0CC89379956 

Write Block: 44 FastBloc2 FE 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. as expected 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results achieved 

August 2008 94 of 114 Test Results for EnCase 5.05f June 2008
5.2.44 DA-14-PASSWORD 

Test Case DA-14-PASSWORD EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are 

not modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester Name: mrmw 

Test Host: Frank 

Test Date: Fri Jun 22 07:00:33 2007 

Drives: src(43) dst (85) other (02-fu) 

Source 

Setup: 

src hash (SHA1): < 888E2E7F7AD237DC7A732281DD93F325065E5871 > 

src hash (MD5): < BC39C3F7EE7A50E77B9BA1E65A5AEEF7 > 

78125000 total sectors (40000000000 bytes) 

Model (0BB-75JHC0 ) serial # ( WD-WMAMC46588) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057143205 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027712125 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027712062 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027712062 sectors 14188575744 bytes 

Log 

Highlights: 

Destination setup 

156301488 sectors wiped with 85 

 

Comparision of original to clone Drive 

Sectors compared: 78125000 

Sectors match: 78125000 

Sectors differ: 0 

Bytes differ: 0 

Diffs range 

Source (78125000) has 78176488 fewer sectors than destination (156301488) 

Zero fill: 0 

Src Byte fill (43): 0 

Dst Byte fill (85): 78176488 

Other fill: 0 

Other no fill: 0 

Zero fill range: 

August 2008 95 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-14-PASSWORD EnCase 5.05f 

Src fill range: 

Dst fill range: 78125000-156301487 

Other fill range: 

Other not filled range: 

0 source read errors, 0 destination read errors 

 

Start: 06/22/07 07:10:54AM 

Total Sectors: 156,301,488 

Input Hash: BC39C3F7EE7A50E77B9BA1E65A5AEEF7 

Actual Date:06/13/07 07:28:22AM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:bc39c3f7ee7a50e77b9ba1e65a5aeef7 

Verify Hash:bc39c3f7ee7a50e77b9ba1e65a5aeef7 

EnCase Version:5.05f 

System Version:Windows XP 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:40,000,000,000 bytes (37.3GB) 

Total Sectors:78,125,000 

Settings: fill none 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. as expected 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results achieved 

August 2008 96 of 114 Test Results for EnCase 5.05f June 2008
5.2.45 DA-14-SCSI 

Test Case DA-14-SCSI EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the clone 

device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are not 

modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester 

Name: 

mrmw 

Test Host: Freddy 

Test Date: Fri Nov 30 13:01:10 2007 

Drives: src(2A) dst (2E) other (06-FU) 

Source 

Setup: 

src hash (SHA256): < 

AE8E839101661367D92803D5F5D408268635EFD8A05FEA633838CDC3919F5ABA > 

src hash (SHA1): < F5F9F2903DCAB895F36E270FB22A722E27918125 > 

src hash (MD5): < 91E0AC905F682ECF6DE4E9835089B519 > 

17783249 total sectors (9105023488 bytes) 

Model (QM39100TD-SCA ) serial # (PCB=20-116711-06 HDAQM39100TD-SCA ) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 017751762 0000/001/01 1023/254/63 Boot 07 NTFS 

 2 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 3 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 4 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 017751762 sectors 9088902144 bytes 

Log 

Highlights: 

Destination setup 

17783249 sectors wiped with 2A 

 

Comparision of original to clone Drive 

Sectors compared: 17783249 

Sectors match: 17783249 

Sectors differ: 0 

Bytes differ: 0 

Diffs range 

0 source read errors, 0 destination read errors 

 

Start: 11/30/07 01:37:24PM 

Total Sectors: 17,783,249 

Input Hash: 91E0AC905F682ECF6DE4E9835089B519 

Actual Date:11/30/07 11:34:50AM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:91e0ac905f682ecf6de4e9835089b519 

Verify Hash:91e0ac905f682ecf6de4e9835089b519 

EnCase Version:5.05f 

System Version:Windows XP 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:9,105,023,488 bytes (8.5GB) 

Total Sectors:17,783,249 

Settings: fill none 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. as expected 

August 2008 97 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-14-SCSI EnCase 5.05f 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results achieved 

August 2008 98 of 114 Test Results for EnCase 5.05f June 2008
5.2.46 DA-14-THUMB 

Test Case DA-14-THUMB EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are 

not modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester Name: slm 

Test Host: joe 

Test Date: Mon Apr 23 13:03:39 2007 

Drives: src(d5-thumb) dst (d7-thumb) other (-new_log) 

Source 

Setup: 

src hash (SHA1): < D68520EF74A336E49DCCF83815B7B08FDC53E38A > 

src hash (MD5): < C843593624B2B3B878596D8760B19954 > 

505856 total sectors (258998272 bytes) 

Model (usb2.0Flash Disk) serial # () 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 778135908 1141509631 0357/116/40 0357/032/45 Boot 72 other 

 2 P 168689522 1936028240 0288/115/43 0367/114/50 Boot 65 other 

 3 P 1869881465 1936028192 0366/032/33 0357/032/43 Boot 79 other 

 4 P 2885681152 000055499 0372/097/50 0000/010/00 Boot 0D other 

1 1141509631 sectors 584452931072 bytes 

2 1936028240 sectors 991246458880 bytes 

3 1936028192 sectors 991246434304 bytes 

4 000055499 sectors 28415488 bytes 

Log 

Highlights: 

Destination setup 

4001760 sectors wiped with D7 

 

Comparision of original to clone Drive 

Sectors compared: 505856 

Sectors match: 505856 

Sectors differ: 0 

Bytes differ: 0 

Diffs range 

Source (505856) has 3495904 fewer sectors than destination (4001760) 

Zero fill: 0 

Src Byte fill (D5): 0 

Dst Byte fill (D7): 3495904 

Other fill: 0 

Other no fill: 0 

Zero fill range: 

Src fill range: 

Dst fill range: 505856-4001759 

Other fill range: 

Other not filled range: 

0 source read errors, 0 destination read errors 

 

Start: 04/23/07 02:23:07PM 

Total Sectors: 4,001,760 

Input Hash: C843593624B2B3B878596D8760B19954 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. as expected 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

August 2008 99 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-14-THUMB EnCase 5.05f 

 

Analysis: Expected results achieved 

August 2008 100 of 114 Test Results for EnCase 5.05f June 2008
5.2.47 DA-14-UNCOMPRESSED 

Test Case DA-14-UNCOMPRESSED EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are 

not modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester Name: mrmw 

Test Host: Freddy 

Test Date: Fri Nov 30 17:01:26 2007 

Drives: src(43) dst (7C) other (06-FU) 

Source 

Setup: 

src hash (SHA1): < 888E2E7F7AD237DC7A732281DD93F325065E5871 > 

src hash (MD5): < BC39C3F7EE7A50E77B9BA1E65A5AEEF7 > 

78125000 total sectors (40000000000 bytes) 

Model (0BB-75JHC0 ) serial # ( WD-WMAMC46588) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057143205 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027712125 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027712062 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027712062 sectors 14188575744 bytes 

Log 

Highlights: 

Destination setup 

78177792 sectors wiped with 7C 

 

Comparision of original to clone Drive 

Sectors compared: 78125000 

Sectors match: 78125000 

Sectors differ: 0 

Bytes differ: 0 

Diffs range 

Source (78125000) has 52792 fewer sectors than destination (78177792) 

Zero fill: 0 

Src Byte fill (43): 0 

Dst Byte fill (7C): 52792 

Other fill: 0 

Other no fill: 0 

Zero fill range: 

August 2008 101 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-14-UNCOMPRESSED EnCase 5.05f 

Src fill range: 

Dst fill range: 78125000-78177791 

Other fill range: 

Other not filled range: 

0 source read errors, 0 destination read errors 

 

Start: 12/03/07 06:53:12AM 

Total Sectors: 78,177,792 

Input Hash: BC39C3F7EE7A50E77B9BA1E65A5AEEF7 

Actual Date:11/30/07 04:30:48PM 

Acquisition Hash:bc39c3f7ee7a50e77b9ba1e65a5aeef7 

EnCase Version:5.05f 

System Version:Windows 2003 Server 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:40,000,000,000 bytes (37.3GB) 

Total Sectors:78,125,000 

Settings: fill none 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. as expected 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results achieved 

August 2008 102 of 114 Test Results for EnCase 5.05f June 2008
5.2.48 DA-14-USB 

Test Case DA-14-USB EnCase 5.05f 

Case 

Summary: 

DA-14 Create an unaligned clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-17 If requested, any excess sectors on a clone destination device are 

not modified. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester Name: slm 

Test Host: joe 

Test Date: Tue May 8 15:10:28 2007 

Drives: src(01-ide) dst (7e) other (none) 

Source 

Setup: 

src hash (SHA1): < A48BB5665D6DC57C22DB68E2F723DA9AA8DF82B9 > 

src hash (MD5): < F458F673894753FA6A0EC8B8EC63848E > 

78165360 total sectors (40020664320 bytes) 

Model (0BB-00JHC0 ) serial # ( WD-WMAMC74171) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057175335 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027744255 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027744192 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027744192 sectors 14205026304 bytes 

Log 

Highlights: 

Destination setup 

78177792 sectors wiped with 7E 

 

Comparision of original to clone Drive 

Sectors compared: 78165360 

Sectors match: 78165360 

Sectors differ: 0 

Bytes differ: 0 

Diffs range 

Source (78165360) has 12432 fewer sectors than destination (78177792) 

Zero fill: 0 

Src Byte fill (01): 0 

Dst Byte fill (7E): 12432 

Other fill: 0 

Other no fill: 0 

Zero fill range: 

August 2008 103 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-14-USB EnCase 5.05f 

Src fill range: 

Dst fill range: 78165360-78177791 

Other fill range: 

Other not filled range: 

0 source read errors, 0 destination read errors 

 

Start: 05/09/07 11:16:36AM 

Total Sectors: 78,177,792 

Input Hash: F458F673894753FA6A0EC8B8EC63848E 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. as expected 

AO-17 Excess sectors are unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results achieved 

August 2008 104 of 114 Test Results for EnCase 5.05f June 2008
5.2.49 DA-17 

Test Case DA-17 EnCase 5.05f 

Case 

Summary: 

DA-17 Create a truncated clone from an image file. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-19 If there is insufficient space to create a complete clone, a 

truncated clone is created using all available sectors of the clone device. 

AO-20 If a truncated clone is created, the tool notifies the user. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester Name: mrmw 

Test Host: Freddy 

Test Date: Wed May 23 15:04:54 2007 

Drives: src(92) dst (65) other (02-fu) 

Source 

Setup: 

src hash (SHA1): < 63E6F7BD3040A8ADA2CF8FBF66A805B76DF10481 > 

src hash (MD5): < E095DD1BD0B0DD6E603153A3FE1A2F3E > 

58633344 total sectors (30020272128 bytes) 

58167/015/63 (max cyl/hd values) 

58168/016/63 (number of cyl/hd) 

IDE disk: Model (WDC WD300BB-00CAA0) serial # (WD-WMA8H2140350) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 058605057 0000/001/01 1023/254/63 Boot 07 NTFS 

 2 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 3 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

 4 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 058605057 sectors 30005789184 bytes 

Hashes with DCO in place: 

md5:525963C6789423396FE1F3202A8CBD04 

sha1.txt:55A3CFE756B7B0034DCCE71F7D7A477D8681B781 

Log 

Highlights: 

Destination setup 

12594960 sectors wiped with 65 

 

Comparision of original to clone Drive 

Sectors compared: 12594960 

Sectors match: 12594960 

Sectors differ: 0 

Bytes differ: 0 

Diffs range 

Source (52770010) has 40175050 more sectors than destination (12594960) 

0 source read errors, 0 destination read errors 

 

Actual Date:05/23/07 03:54:07PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:525963c6789423396fe1f3202a8cbd04 

Verify Hash:525963c6789423396fe1f3202a8cbd04 

EnCase Version:5.05f 

System Version:Windows XP 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:27,018,245,120 bytes (25.2GB) 

Total Sectors:52,770,010 

Settings: fill none size cd 

Write Block: tableau 32 FW800 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-19 Truncated clone is created. as expected 

August 2008 105 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-17 EnCase 5.05f 

AO-20 User notified that clone is truncated. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results achieved 

August 2008 106 of 114 Test Results for EnCase 5.05f June 2008
5.2.50 DA-22-ATA28 

Test Case DA-22-ATA28 EnCase 5.05f 

Case 

Summary: 

DA-22 Create an unaligned clone from an image file, filling excess sectors. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-18 If requested, a benign fill is written to excess sectors of a clone. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester Name: mrmw 

Test Host: frank 

Test Date: Thu May 24 13:43:22 2007 

Drives: src(43) dst (21) other (01-fu) 

Source 

Setup: 

src hash (SHA1): < 888E2E7F7AD237DC7A732281DD93F325065E5871 > 

src hash (MD5): < BC39C3F7EE7A50E77B9BA1E65A5AEEF7 > 

78125000 total sectors (40000000000 bytes) 

Model (0BB-75JHC0 ) serial # ( WD-WMAMC46588) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057143205 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027712125 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027712062 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027712062 sectors 14188575744 bytes 

Log 

Highlights: 

Destination setup 

195813072 sectors wiped with 21 

 

Comparision of original to clone Drive 

Sectors compared: 78125000 

Sectors match: 78125000 

Sectors differ: 0 

Bytes differ: 0 

Diffs range 

Source (78125000) has 117688072 fewer sectors than destination (195813072) 

Zero fill: 117688072 

Src Byte fill (43): 0 

Dst Byte fill (21): 0 

Other fill: 0 

Other no fill: 0 

Zero fill range: 78125000-195813071 

Src fill range: 

August 2008 107 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-22-ATA28 EnCase 5.05f 

Dst fill range: 

Other fill range: 

Other not filled range: 

0 source read errors, 0 destination read errors 

 

Actual Date:05/25/07 02:14:22PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:bc39c3f7ee7a50e77b9ba1e65a5aeef7 

Verify Hash:bc39c3f7ee7a50e77b9ba1e65a5aeef7 

EnCase Version:5.05f 

System Version:Windows 2003 Server 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:40,000,000,000 bytes (37.3GB) 

Total Sectors:78,125,000 

Settings: fill 00 size cd 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. as expected 

AO-18 Excess sectors are filled. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results achieved 

August 2008 108 of 114 Test Results for EnCase 5.05f June 2008
5.2.51 DA-22-F16 

Test Case DA-22-F16 EnCase 5.05f 

Case 

Summary: 

DA-22 Create an unaligned clone from an image file, filling excess sectors. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-12 If requested, a clone is created from an image file. 

AO-13 A clone is created using access interface DST-AI to write to the 

clone device. 

AO-14 If an unaligned clone is created, each sector written to the clone is 

accurately written to the same disk address on the clone that the sector 

occupied on the digital source. 

AO-18 If requested, a benign fill is written to excess sectors of a clone. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester 

Name: 

mrmw 

Test Host: Frank 

Test Date: Wed Oct 31 17:33:34 2007 

Drives: src(43) dst (09-IDE) other (01-FU) 

Source 

Setup: 

src hash (SHA1): < 888E2E7F7AD237DC7A732281DD93F325065E5871 > 

src hash (MD5): < BC39C3F7EE7A50E77B9BA1E65A5AEEF7 > 

78125000 total sectors (40000000000 bytes) 

Model (0BB-75JHC0 ) serial # ( WD-WMAMC46588) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057143205 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027712125 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027712062 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027712062 sectors 14188575744 bytes 

Log 

Highlights: 

Destination setup 

23444165 sectors wiped with 9 

Comparision of original to clone Partition 

Sectors compared: 2104452 

Sectors match: 2104452 

Sectors differ: 0 

Bytes differ: 0 

Diffs range: 

Source (2104452) has 2506140 fewer sectors than destination (4610592) 

Zero fill: 0 

Src Byte fill (43): 0 

Dst Byte fill (09): 0 

Other fill: 2506140 

Other no fill: 0 

Zero fill range: 

Src fill range: 

August 2008 109 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-22-F16 EnCase 5.05f 

Dst fill range: 

Other fill range: 2104452-4610591 

Other not filled range: 

run start Thu Nov 1 13:56:52 2007 

run finish Thu Nov 1 14:00:26 2007 

elapsed time 0:3:34 

Normal exit 

Total Capacity:1,077,479,424 bytes (1GB) 

Total Clusters:2,104,452Unallocated:1,077,479,424 bytes (1GB) 

Actual Date:09/25/07 03:08:01PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:37e81ffb31c3cb38aa48b2237500908e 

Verify Hash:37e81ffb31c3cb38aa48b2237500908e 

EnCase Version:5.05f 

System Version:Windows 2003 Server 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:1,077,479,424 bytes (1GB) 

Total Sectors:2,104,452 

Settings: fill 5A 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-12 A clone is created from an image file. as expected 

AO-13 Clone created using interface AI. as expected 

AO-14 An unaligned clone is created. as expected 

AO-18 Excess sectors are filled. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results achieved 

August 2008 110 of 114 Test Results for EnCase 5.05f June 2008
5.2.52 DA-24 

Test Case DA-24 EnCase 5.05f 

Case 

Summary: 

DA-24 Verify a valid image. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-06 If the tool performs an image file integrity check on an image file 

that has not been changed since the file was created, the tool shall notify 

the user that the image file has not been changed. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester 

Name: 

mrmw 

Test Host: Freddy 

Test Date: Fri May 25 17:51:24 2007 

Drives: src(01) dst (none) other (02-fu) 

Source 

Setup: 

src hash (SHA1): < A48BB5665D6DC57C22DB68E2F723DA9AA8DF82B9 > 

src hash (MD5): < F458F673894753FA6A0EC8B8EC63848E > 

78165360 total sectors (40020664320 bytes) 

Model (0BB-00JHC0 ) serial # ( WD-WMAMC74171) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057175335 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027744255 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027744192 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027744192 sectors 14205026304 bytes 

Log 

Highlights: 

Actual Date:04/06/07 12:38:27PM 

File Integrity:Completely Verified, 0 Errors 

Acquisition Hash:f458f673894753fa6a0ec8b8ec63848e 

Verify Hash:f458f673894753fa6a0ec8b8ec63848e 

EnCase Version:5.05f 

System Version:Windows 2000 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:0 

Total Size:40,020,664,320 bytes (37.3GB) 

Total Sectors:78,165,360 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-06 Tool verifies image file unchanged. as expected 

AO-23 Logged information is correct. as expected 

 

August 2008 111 of 114 Test Results for EnCase 5.05f June 2008
Test Case DA-24 EnCase 5.05f 

Analysis: Expected results achieved 

August 2008 112 of 114 Test Results for EnCase 5.05f June 2008
5.2.53 DA-25 

Test Case DA-25 EnCase 5.05f 

Case 

Summary: 

DA-25 Detect a corrupted image. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-07 If the tool performs an image file integrity check on an image file 

that has been changed since the file was created, the tool shall notify the 

user that the image file has been changed. 

AO-08 If the tool performs an image file integrity check on an image file 

that has been changed since the file was created, the tool shall notify the 

user of the affected locations. 

AO-23 If the tool logs any log significant information, the information is 

accurately recorded in the log file. 

Tester 

Name: 

mrmw 

Test Host: Max 

Test Date: Tue Jul 3 13:29:19 2007 

Drives: src(01) dst (none) other (04-fu) 

Source 

Setup: 

src hash (SHA1): < A48BB5665D6DC57C22DB68E2F723DA9AA8DF82B9 > 

src hash (MD5): < F458F673894753FA6A0EC8B8EC63848E > 

78165360 total sectors (40020664320 bytes) 

Model (0BB-00JHC0 ) serial # ( WD-WMAMC74171) 

 N Start LBA Length Start C/H/S End C/H/S boot Partition type 

 1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

 2 X 020980890 057175335 1023/000/01 1023/254/63 0F extended 

 3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

 4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

 5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

 6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

 7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

 8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

 9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap 

14 x 029431080 027744255 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027744192 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry 

1 020980827 sectors 10742183424 bytes 

3 000032067 sectors 16418304 bytes 

5 002104452 sectors 1077479424 bytes 

7 004192902 sectors 2146765824 bytes 

9 008401932 sectors 4301789184 bytes 

11 010490382 sectors 5371075584 bytes 

13 004208967 sectors 2154991104 bytes 

15 027744192 sectors 14205026304 bytes 

Log 

Highlights: 

Image file corrupted for test run: 

Change byte 11370496 of file /tmp/da-10-uncompressed.E02 from 0x33 to 0x94 

Starting Extent:0S0 

Actual Date:06/30/07 01:36:26AM 

File Integrity:Completely Verified, 1 Errors 

Acquisition Hash:bc39c3f7ee7a50e77b9ba1e65a5aeef7 

Verify Hash:7136e55fa3f5f761d7c938510c042c26 

EnCase Version:5.05f 

System Version:Windows 2000 

Error Granularity:64 

Read Errors:0 

Missing Sector Errors:0 

CRC Errors:1 

Total Size:40,000,000,000 bytes (37.3GB) 

Total Sectors:78,125,000 

Results: 

August 2008 113 of 114 Test Results for EnCase 5.05f June 2008
August 2008 114 of 114 Test Results for EnCase 5.05f June 2008

Test Case DA-25 EnCase 5.05f 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected 

AO-07 User notified if image file has changed. as expected 

AO-08 User notified of changed locations. as expected 

AO-23 Logged information is correct. as expected 

 

Analysis: Expected results achieved 
About the National Institute of Justice

NIJ is the research, development, and evaluation agency of the U.S. Department of Justice. NIJ’s

mission is to advance scientific research, development, and evaluation to enhance the administration of justice and public safety. NIJ’s principal authorities are derived from the Omnibus

Crime Control and Safe Streets Act of 1968, as amended (see 42 U.S.C. §§ 3721–3723).

The NIJ Director is appointed by the President and confirmed by the Senate. The Director establishes the Institute’s objectives, guided by the priorities of the Office of Justice Programs, the

U.S. Department of Justice, and the needs of the field. The Institute actively solicits the views of

criminal justice and other professionals and researchers to inform its search for the knowledge

and tools to guide policy and practice.

Strategic Goals

NIJ has seven strategic goals grouped into three categories: 

Creating relevant knowledge and tools

1. Partner with State and local practitioners and policymakers to identify social science research

and technology needs. 

2. Create scientific, relevant, and reliable knowledge—with a particular emphasis on terrorism,

violent crime, drugs and crime, cost-effectiveness, and community-based efforts—to enhance

the administration of justice and public safety. 

3. Develop affordable and effective tools and technologies to enhance the administration of

justice and public safety. 

Dissemination

4. Disseminate relevant knowledge and information to practitioners and policymakers in an

understandable, timely, and concise manner. 

5. Act as an honest broker to identify the information, tools, and technologies that respond to

the needs of stakeholders. 

Agency management

6. Practice fairness and openness in the research and development process.

7. Ensure professionalism, excellence, accountability, cost-effectiveness, and integrity in the

management and conduct of NIJ activities and programs. 

Program Areas

In addressing these strategic challenges, the Institute is involved in the following program areas:

crime control and prevention, including policing; drugs and crime; justice systems and offender

behavior, including corrections; violence and victimization; communications and information

technologies; critical incident response; investigative and forensic sciences, including DNA; lessthan-lethal technologies; officer protection; education and training technologies; testing and

standards; technology assistance to law enforcement and corrections agencies; field testing of

promising programs; and international crime control. 

In addition to sponsoring research and development and technology assistance, NIJ evaluates

programs, policies, and technologies. NIJ communicates its research and evaluation findings

through conferences and print and electronic media.

To find out more about the National

Institute of Justice, please visit:

http://www.ojp.usdoj.gov/nij

or contact:

National Criminal Justice 

Reference Service

P.O. Box 6000

Rockville, MD 20849–6000

800–851–3420

http://www.ncjrs.gov