U.S. Department of Justice 

Office of Justice Programs 

National Institute of Justice 

Special REPORT

Test Results for Digital Data Acquisition Tool: 

FTK Imager 2.5.3.14 

JUN. 08 

Office of Justice Programs 

Innovation • Partnerships • Safer Neighborhoods 

www.ojp.usdoj.gov

www.ojp.usdoj.gov/nij 
U.S. Department of Justice 

Office of Justice Programs 

810 Seventh Street N.W. 

Washington, DC 20531 

Michael B. Mukasey 

Attorney General 

Jeffrey L. Sedgwick 

Acting Assistant Attorney General 

David W. Hagy 

Director, National Institute of Justice 

This and other publications and products of the National Institute 

of Justice can be found at: 

National Institute of Justice 

www.ojp.usdoj.gov/nij 

Office of Justice Programs 

Innovation • Partnerships • Safer Neighborhoods 

www.ojp.usdoj.gov 
JUN. 08 

Test Results for Digital Data Acquisition Tool: 

FTK Imager 2.5.3.14 

NCJ 222982
 
David W. Hagy 

Director, National Institute of Justice 

This report was prepared for the National Institute of Justice, U.S. Department of Justice, by the 

Office of Law Enforcement Standards of the National Institute of Standards and Technology 

under Interagency Agreement 2003–IJ–R–029. 

The National Institute of Justice is a component of the Office of Justice Programs, which also 

includes the Bureau of Justice Assistance, the Bureau of Justice Statistics, the Office of 

Juvenile Justice and Delinquency Prevention, and the Office for Victims of Crime. 
March 3, 2008 

Test Results for Digital Data Acquisition Tool: 

FTK Imager 2.5.3.14 
June 2008 ii Results of FTK Imager 2.5.3.14 3/3/2008 
Contents 

1 Results Summary .................................................................................................................... 2 
 


2 Test Case Selection................................................................................................................. 2 
 


3 Results by Test Assertion........................................................................................................ 3 
 


3.1 Eight Sectors Omitted from Logical Acquisition of NTFS Partition ............................. 5 
 


3.2 Acquisition of HPA and DCO ........................................................................................ 6 
 


3.3 Location of Corrupted Data in Image File...................................................................... 6 
 


4 Testing Environment............................................................................................................... 6 
 


4.1 Test Computers ............................................................................................................... 6 
 


4.2 Support Software ............................................................................................................ 6 
 


5 Test Results............................................................................................................................. 6 
 


5.1 Test Results Report Key ................................................................................................. 7 
 


5.2 Test Details ..................................................................................................................... 7 
 


5.2.1 DA-06-ATA28........................................................................................................ 7 
 


5.2.2 DA-06-FLOPPY ..................................................................................................... 9 
 


5.2.3 DA-06-FW ............................................................................................................ 10 
 


5.2.4 DA-06-USB .......................................................................................................... 12 
 


5.2.5 DA-07-CF ............................................................................................................. 14 
 


5.2.6 DA-07-F12............................................................................................................ 16 
 


5.2.7 DA-07-F16............................................................................................................ 18 
 


5.2.8 DA-07-32 .............................................................................................................. 20 
 


5.2.9 DA-07-32X ........................................................................................................... 22 
 


5.2.10 DA-07-NTFS ........................................................................................................ 24 
 


5.2.11 DA-07-THUMB.................................................................................................... 26 
 


5.2.12 DA-08-ATA28...................................................................................................... 28 
 


5.2.13 DA-08-ATA48...................................................................................................... 30 
 


5.2.14 DA-08-DCO.......................................................................................................... 32 
 


5.2.15 DA-09 ................................................................................................................... 34 
 


5.2.16 DA-10-DD ............................................................................................................ 37 
 


5.2.17 DA-10-SMART .................................................................................................... 39 
 


5.2.18 DA-12 ................................................................................................................... 41 
 


5.2.19 DA-24-DD ............................................................................................................ 43 
 


5.2.20 DA-25-DD ............................................................................................................ 45 
 


5.2.21 DA-26-E01-TO-SMART...................................................................................... 46 
 


5.2.22 DA-26-E01-TO-DD.............................................................................................. 47 
 


5.2.23 DA-26-SMART-TO-E01...................................................................................... 48 
 


5.2.24 DA-26-SMART-TO-DD....................................................................................... 49 
 


5.2.25 DA-26-DD-TO-E01.............................................................................................. 50 
 


5.2.26 DA-26-DD-TO-SMART....................................................................................... 51 
 


June 2008 iii Results of FTK Imager 2.5.3.14 3/3/2008 
June 2008 iv Results of FTK Imager 2.5.3.14 3/3/2008 
Introduction 

The Computer Forensics Tool Testing (CFTT) program is a joint project of the National 

Institute of Justice (NIJ), the research and development organization of the U.S. 

Department of Justice, and the National Institute of Standards and Technology’s (NIST’s) 

Office of Law Enforcement Standards and Information Technology Laboratory. CFTT is 

supported by other organizations, including the Federal Bureau of Investigation, the U.S. 

Department of Defense Cyber Crime Center, U.S. Internal Revenue Service Criminal 

Investigation Division Electronic Crimes Program, and the U.S. Department of 

Homeland Security’s Bureau of Immigration and Customs Enforcement, U.S. Customs 

and Border Protection, and U.S. Secret Service. The objective of the CFTT program is to 

provide measurable assurance to practitioners, researchers, and other applicable users that 

the tools used in computer forensics investigations provide accurate results. 

Accomplishing this requires the development of specifications and test methods for 

computer forensics tools and subsequent testing of specific tools against those 

specifications. 

Test results provide the information necessary for developers to improve tools, users to 

make informed choices, and the legal community and others to understand the tools’ 

capabilities. This approach to testing computer forensic tools is based on well-recognized 

methodologies for conformance and quality testing. The specifications and test methods 

are posted on the CFTT Web site (http://www.cftt.nist.gov/) for review and comment by 

the computer forensics community. 

This document reports the results from testing FTK Imager, version 2.5.3.14, against the 

Digital Data Acquisition Tool Assertions and Test Plan Version 1.0, available at the 

CFTT Web site (http://www.cftt.nist.gov/DA-ATP-pc-01.pdf). 

Test results from other software packages and the CFTT tool methodology can be found 

on NIJ’s computer forensics tool testing Web page, 

http://www.ojp.usdoj.gov/nij/topics/technology/electronic-crime/cftt.htm. 
 

 

Test Results for Digital Data Acquisition Tool 

Tool Tested: FTK Imager 

Version: 2.5.3.14 

Run Environments: Windows XP, Windows Server 2003 & Windows 2000 

Supplier: 	 	 AccessData 

Address: 	 	 384 South 400 West 

Suite 200 

Lindon, UT 84042 USA 

Tel: 801–377–5410 

Fax: 801–765–4370 

WWW: http://www.accessdata.com/ 

1 Results Summary 

Except for two test cases (DA–07 and DA–08), the tested tool acquired all visible and 

hidden sectors completely and accurately from the test media without any anomalies. In 

one test case (DA-25) image file corruption was detected, but the location of the corrupt 

data was not reported. The following four anomalies were observed in test cases DA–07, 

DA–08, and DA–25: 

1.	 If a logical acquisition is made of an NTFS partition, the last eight sectors of the 

physical partition are not acquired (DA–07–NTFS). 

2.	 The sectors hidden by a host protected area (HPA) are not acquired (DA–08– 

ATA28 and DA–08–ATA48). 

3.	 The sectors hidden by a device configuration overlay (DCO) are not acquired 

(DA–08–DCO). 

4.	 The location of corrupted data in an image file is not reported (DA–25). 

2 Test Case Selection 

Not all test cases or test assertions defined in Digital Data Acquisition Tool Assertions 

and Test Plan Version 1.0 are appropriate for all tools. In addition to the base test cases, 

each remaining test case is linked to optional tool features needed for the test case. If a 

given tool implements a given feature then the test cases linked to that feature are run. 

Table 1 lists the features available in FTK Imager 2.5.3.14 and the linked test cases 

selected for execution. Table 2 lists the features not available in FTK Imager 2.5.3.14 and 

the test cases not executed. 

Table 1 Selected Test Cases 

Supported Optional Feature Cases selected for execution 

June 2008 	 	 2 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

Supported Optional Feature Cases selected for execution 

Base Cases 06, 07 & 08 

Read error during acquisition 09 

Create an image file in more than one format 10 

Insufficient space for image file 12 

Detect a corrupted (or changed) image file 24 & 25 

Convert an image file from one format to 

another 

26 

Table 2 Omitted Test Cases 

Unsupported Optional Feature Cases omitted (not executed) 

Create a clone during acquisition 01, 02 & 04 

Create cylinder aligned clones 03, 15, 21 & 23 

Device I/O error generator available 05, 11 & 18 

Destination Device Switching 13 

Create a clone from an image file 14 & 17 

Create a clone from a subset of an image file 16 

Fill excess sectors acquired to a clone device 19 & 20 

Fill excess sectors on a clone device 22 

Some test cases have variant forms to accommodate parameters within test assertions. 

These variations cover the execution environment, acquisition interface to the source 

drive, and type of digital object acquired. Variations were also created for image file 

format. 

The tool was executed in one of the following Microsoft run time environments: 

Windows XP, Windows Server 2003 or Windows 2000. 

The following source interfaces were tested: ATA28, ATA48, USB, and FireWire. 

The following digital sources were tested: partitions (FAT12, FAT16, FAT32, FAT32X, 

and NTFS), compact flash, and thumb drive. 

The image files were created on either NTFS or FAT32 partitions. 

3 Results by Test Assertion 

Table 3 summarizes the test results by assertion. The column labeled Assertions Tested 

gives the text of each assertion. The column labeled Tests gives the number of test cases 

that use the given assertion. The column labeled Anomaly gives the section number in 

this report where any anomalies found for the assertion are discussed. 

June 2008 3 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

Table 3 Assertions Tested 

Assertions Tested Tests Anomaly 

AM–01 The tool uses access interface SRC-AI to access the digital 

source. 

18 

AM–02 The tool acquires digital source DS. 18 

AM–03 The tool executes in execution environment XE. 26 

AM–05 If image file creation is specified, the tool creates an image 

file on file system type FS. 

18 

AM–06 All visible sectors are acquired from the digital source. 17 3.1 

AM–07 All hidden sectors are acquired from the digital source. 3 3.2 

AM–08 All sectors acquired from the digital source are acquired 

accurately. 

17 

AM–09 If unresolved errors occur while reading from the selected 

digital source, the tool notifies the user of the error type and location 

within the digital source. 

1 

AM–10 If unresolved errors occur while reading from the selected 

digital source, the tool uses a benign fill in the destination object in 

place of the inaccessible data. 

1 

AO–01 If the tool creates an image file, the data represented by the 

image file is the same as the data acquired by the tool. 

17 

AO–02 If an image file format is specified, the tool creates an image 

file in the specified format. 

2 

AO–04 If the tool is creating an image file and there is insufficient 

space on the image destination device to contain the image file, the 

tool shall notify the user. 

1 

AO–05 If the tool creates a multi-file image of a requested size then 

all the individual files shall be no larger than the requested size. 

17 

AO–06 If the tool performs an image file integrity check on an image 

file that has not been changed since the file was created, the tool shall 

notify the user that the image file has not been changed. 

1 

AO–07 If the tool performs an image file integrity check on an image 

file that has been changed since the file was created, the tool shall 

notify the user that the image file has been changed. 

1 

AO–08 If the tool performs an image file integrity check on an image 

file that has been changed since the file was created, the tool shall 

notify the user of the affected locations. 

1 3.3 

AO–09 If the tool converts a source image file from one format to a 

target image file in another format, the acquired data represented in 

the target image file is the same as the acquired data in the source 

image file. 

6 

AO–23 If the tool logs any log significant information, the 

information is accurately recorded in the log file. 

26 

Two test assertions only apply in special circumstances. The assertion AO–22 is checked 

only for tools that create block hashes. This assertion does not apply to FTK Imager 

June 2008 4 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
2.5.3.14. The assertion AO–24 is only checked if the tool is executed in a run time 

environment that does not modify attached storage devices, such as MS DOS. A write 

blocker was used during the tests, so assertion AO–24 was not checked. Table 4 lists the 

assertions that were not tested, usually due to the tool not supporting some optional 

feature, e.g., creation of cylinder aligned clones. 

Table 4 Assertions Not Tested 

Assertions Not Tested 

AM–04 If clone creation is specified, the tool creates a clone of the digital source. 

AO–03 If there is an error while writing the image file, the tool notifies the user. 

AO–10 If there is insufficient space to contain all files of a multi-file image and if 

destination device switching is supported, the image is continued on another device. 

AO–11 If requested, a clone is created during an acquisition of a digital source. 

AO–12 If requested, a clone is created from an image file. 

AO–13 A clone is created using access interface DST-AI to write to the clone device. 

AO–14 If an unaligned clone is created, each sector written to the clone is accurately 

written to the same disk address on the clone that the sector occupied on the digital 

source. 

AO–15 If an aligned clone is created, each sector within a contiguous span of sectors 

from the source is accurately written to the same disk address on the clone device relative 

to the start of the span as the sector occupied on the original digital source. A span of 

sectors is defined to be either a mountable partition or a contiguous sequence of sectors 

not part of a mountable partition. Extended partitions, which may contain both mountable 

partitions and unallocated sectors, are not mountable partitions. 

AO–16 If a subset of an image or acquisition is specified, all the subset is cloned. 

AO–17 If requested, any excess sectors on a clone destination device are not modified. 

AO–18 If requested, a benign fill is written to excess sectors of a clone. 

AO–19 If there is insufficient space to create a complete clone, a truncated clone is 

created using all available sectors of the clone device. 

AO–20 If a truncated clone is created, the tool notifies the user. 

AO–21 If there is a write error during clone creation, the tool notifies the user. 

AO–22 If requested, the tool calculates block hashes for a specified block size during an 

acquisition for each block acquired from the digital source. 

AO–24 If the tool executes in a forensically safe execution environment, the digital 

source is unchanged by the acquisition process. 

3.1	 Eight Sectors Omitted from Logical Acquisition of NTFS 

Partition 

If a logical acquisition is made of an NTFS partition the last eight sectors of the physical 

partition are not acquired (DA–07–NTFS). The physical partition used in the test case 

had 27,744,192 sectors, but the FTK Imager acquired only the first 27,744,184 sectors. 

June 2008 	 5 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
3.2 Acquisition of HPA and DCO 

If a physical acquisition is made of a drive with hidden sectors in either a Host Protected 

Area or a Device Configuration Overlay, the tool does not remove either an HPA or a 

DCO. The tool did not acquire sectors hidden by an HPA (DA–08–ATA28 and DA–08– 

ATA48) or a DCO (DA–08–DCO). 

3.3 Location of Corrupted Data in Image File 

In one test case (DA–25) image file corruption was detected, but the location of the 

corrupted data was not reported to the user. 

4 Testing Environment 

The tests were run in the NIST CFTT lab. This section describes the test computers 

available for testing. 

4.1 Test Computers 

Two test computers were used. 

Frank and Freddy have the following configuration: 

Intel® Desktop Motherboard D865GB/D865PERC (with ATA–6 IDE on board 

controller) 

BIOS Version BF86510A.86A.0053.P13 

Adaptec SCSI BIOS V3.10.0 

Intel® PentiumTM 4 CPU 3.4Ghz 

2577972KB RAM 

SONY DVD RW DRU–530A, ATAPI CD/DVD-ROM drive 

1.44 MB floppy drive 

Two slots for removable IDE hard disk drives 

Two slots for removable SATA hard disk drives 

Two slots for removable SCSI hard disk drives 

4.2 Support Software 

A package of programs to support test analysis, FS–TST Release 2.0, was used. The 

software can be obtained from: http://www.cftt.nist.gov/diskimaging/fs-tst20.zip. 

5 Test Results 

The main item of interest for interpreting the test results is determining the conformance 

of the tool under test with the test assertions. Conformance with each assertion tested by a 

given test case is evaluated by examining the Log Highlights box of the test report 

summary. 

June 2008 6 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
5.1 Test Results Report Key 

A summary of the actual test results is presented in this report. The following table 

presents a description of each section of the test report summary. 

Heading Description 

First Line: Test case ID, name, and version of tool tested. 

Case Summary: Test case summary from Digital Data Acquisition Tool 

Assertions and Test Plan Version 1.0. 

Assertions: The test assertions applicable to the test case, selected from 

Digital Data Acquisition Tool Assertions and Test Plan 

Version 1.0. 

Tester Name: Name or initials of person executing test procedure. 

Test Host: Host computer executing the test. 

Test Date: Time and date that test was started. 

Drives: Source drive (the drive acquired), destination drive (if a 

clone is created) and media drive (to contain a created 

image). 

Source Setup: Layout of partitions on the source drive and the expected 

hash of the drive. 

Log Highlights: Information extracted from various log files to illustrate 

conformance or nonconformance to the test assertions. 

Results: Expected and actual results for each assertion tested. 

Analysis: Whether or not the expected results were achieved. 

5.2 Test Details 

5.2.1 DA-06-ATA28 

Test Case DA-06-ATA28 FTK Imager 2.5.3.14

Case 

Summary: 

DA-06 Acquire a physical device using access interface AI to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source.

AM-02 The tool acquires digital source DS.

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file

on file system type FS.

AM-06 All visible sectors are acquired from the digital source.

AM-08 All sectors acquired from the digital source are acquired accurately.

AO-01 If the tool creates an image file, the data represented by the image

file is the same as the data acquired by the tool.

AO-05 If the tool creates a multi-file image of a requested size then all

the individual files shall be no larger than the requested size.

AO-22 If requested, the tool calculates block hashes for a specified block

size during an acquisition for each block acquired from the digital source.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file.

AO-24 If the tool executes in a forensically safe execution environment,

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 

Test Host: Freddy

Test Date: Tue Oct 30 11:03:37 2007 

Drives: src(43) dst (none) other (01-FU)

Source src hash (SHA1): < 888E2E7F7AD237DC7A732281DD93F325065E5871 > 

June 2008 7 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Test Case DA-06-ATA28 FTK Imager 2.5.3.14

Setup: src hash (MD5): < BC39C3F7EE7A50E77B9BA1E65A5AEEF7 >

78125000 total sectors (40000000000 bytes)

Model (0BB-75JHC0 ) serial # ( WD-WMAMC46588)

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

2 X 020980890 057143205 1023/000/01 1023/254/63 0F extended 

3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap

14 x 029431080 027712125 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027712062 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

1 020980827 sectors 10742183424 bytes

3 000032067 sectors 16418304 bytes

5 002104452 sectors 1077479424 bytes

7 004192902 sectors 2146765824 bytes

9 008401932 sectors 4301789184 bytes

11 010490382 sectors 5371075584 bytes

13 004208967 sectors 2154991104 bytes

15 027712062 sectors 14188575744 bytes 

Log

Highlights: 

Created By AccessData® FTK® Imager 2.5.3.14 071018

Sector Count: 78,125,000

Source data size: 38146 MB 

MD5 checksum: bc39c3f7ee7a50e77b9ba1e65a5aeef7 

SHA1 checksum: 888e2e7f7ad237dc7a732281dd93f325065e5871 

Acquisition started: Tue Oct 30 12:34:11 2007 

Acquisition finished: Tue Oct 30 14:00:39 2007 

Verification started: Tue Oct 30 14:00:39 2007 

Verification finished: Tue Oct 30 14:06:46 2007 

MD5 checksum: bc39c3f7ee7a50e77b9ba1e65a5aeef7 : verified 

SHA1 checksum: 888e2e7f7ad237dc7a732281dd93f325065e5871 : verified 

Settings: size CD (640 MB)Write Block: 19 NoWrite 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected

AM-02 Source is type DS. as expected

AM-03 Execution environment is XE. as expected

AM-05 An image is created on file system type FS. as expected

AM-06 All visible sectors acquired. as expected

AM-08 All sectors accurately acquired. as expected

AO-01 Image file is complete and accurate. as expected

AO-05 Multifile image created. as expected

AO-22 Tool calculates hashes by block. option not available

AO-23 Logged information is correct. as expected

AO-24 Source is unchanged by acquisition. not checked 

Analysis: Expected results achieved 

June 2008 8 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

5.2.2 DA-06-FLOPPY 
 
 Test Case DA-06-FLOPPY FTK Imager 2.5.3.14

Case 

Summary: 

DA-06 Acquire a physical device using access interface AI to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source.

AM-02 The tool acquires digital source DS.

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file

on file system type FS.

AM-06 All visible sectors are acquired from the digital source.

AM-08 All sectors acquired from the digital source are acquired accurately.

AO-01 If the tool creates an image file, the data represented by the image

file is the same as the data acquired by the tool.

AO-05 If the tool creates a multi-file image of a requested size then all

the individual files shall be no larger than the requested size.

AO-22 If requested, the tool calculates block hashes for a specified block

size during an acquisition for each block acquired from the digital source.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file.

AO-24 If the tool executes in a forensically safe execution environment,

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 

Test Host: Freddy

Test Date: Tue Oct 30 14:06:09 2007 

Drives: src(floppy) dst (none) other (01-FU)

Source 

Setup: 

src hash (SHA1): < e2863334ac7eaabc7c8a0d62eb0d3b3af29f2c40 >

src hash (MD5): < 17f6a5925be2f38eedaf435ff8b6a6f4 >

Floppy disk

Log

Highlights: 

Created By AccessData® FTK® Imager 2.5.3.14 071018

Sector Count: 2,880

Source data size: 1 MB 

MD5 checksum: 17f6a5925be2f38eedaf435ff8b6a6f4 

SHA1 checksum: e2863334ac7eaabc7c8a0d62eb0d3b3af29f2c40 

Acquisition started: Tue Oct 30 14:11:19 2007 

Acquisition finished: Tue Oct 30 14:12:45 2007 

Verification started: Tue Oct 30 14:12:45 2007 

Verification finished: Tue Oct 30 14:12:45 2007 

MD5 checksum: 17f6a5925be2f38eedaf435ff8b6a6f4 : verified 

SHA1 checksum: e2863334ac7eaabc7c8a0d62eb0d3b3af29f2c40 : verified 

Settings: CD (640 MB) 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected

AM-02 Source is type DS. as expected

AM-03 Execution environment is XE. as expected

AM-05 An image is created on file system type FS. as expected

AM-06 All visible sectors acquired. as expected

AM-08 All sectors accurately acquired. as expected

AO-01 Image file is complete and accurate. as expected

AO-05 Multifile image created. as expected

AO-22 Tool calculates hashes by block. option not available

AO-23 Logged information is correct. as expected

AO-24 Source is unchanged by acquisition. not checked 

Analysis: Expected results achieved 

June 2008 9 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

5.2.3 DA-06-FW 
 
 Test Case DA-06-FW FTK Imager 2.5.3.14

Case 

Summary: 

DA-06 Acquire a physical device using access interface AI to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source.

AM-02 The tool acquires digital source DS.

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file

on file system type FS.

AM-06 All visible sectors are acquired from the digital source.

AM-08 All sectors acquired from the digital source are acquired accurately.

AO-01 If the tool creates an image file, the data represented by the image

file is the same as the data acquired by the tool.

AO-05 If the tool creates a multi-file image of a requested size then all

the individual files shall be no larger than the requested size.

AO-22 If requested, the tool calculates block hashes for a specified block

size during an acquisition for each block acquired from the digital source.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file.

AO-24 If the tool executes in a forensically safe execution environment,

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 

Test Host: Freddy

Test Date: Wed Oct 31 10:35:32 2007 

Drives: src(01-IDE) dst (none) other (01-FU)

Source src hash (SHA1): < A48BB5665D6DC57C22DB68E2F723DA9AA8DF82B9 >

Setup: src hash (MD5): < F458F673894753FA6A0EC8B8EC63848E >

78165360 total sectors (40020664320 bytes)

Model (0BB-00JHC0 ) serial # ( WD-WMAMC74171)

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

2 X 020980890 057175335 1023/000/01 1023/254/63 0F extended 

3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap

14 x 029431080 027744255 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027744192 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

1 020980827 sectors 10742183424 bytes

3 000032067 sectors 16418304 bytes

5 002104452 sectors 1077479424 bytes

7 004192902 sectors 2146765824 bytes

9 008401932 sectors 4301789184 bytes

11 010490382 sectors 5371075584 bytes

13 004208967 sectors 2154991104 bytes

15 027744192 sectors 14205026304 bytes 

Log

Highlights: 

Created By AccessData® FTK® Imager 2.5.3.14 071018

Sector Count: 78,165,360

Source data size: 38166 MB 

MD5 checksum: f458f673894753fa6a0ec8b8ec63848e 

SHA1 checksum: a48bb5665d6dc57c22db68e2f723da9aa8df82b9 

Acquisition started: Wed Oct 31 10:41:27 2007 

Acquisition finished: Wed Oct 31 11:18:26 2007 

Verification started: Wed Oct 31 11:18:26 2007 

Verification finished: Wed Oct 31 11:23:33 2007 

MD5 checksum: f458f673894753fa6a0ec8b8ec63848e : verified 

June 2008 10 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

Test Case DA-06-FW FTK Imager 2.5.3.14

SHA1 checksum: a48bb5665d6dc57c22db68e2f723da9aa8df82b9 : verified 

Settings: size CD(640MB)

Write Block: 31 Tableau WriteBlocker 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected

AM-02 Source is type DS. as expected

AM-03 Execution environment is XE. as expected

AM-05 An image is created on file system type FS. as expected

AM-06 All visible sectors acquired. as expected

AM-08 All sectors accurately acquired. as expected

AO-01 Image file is complete and accurate. as expected

AO-05 Multifile image created. as expected

AO-22 Tool calculates hashes by block. option not available

AO-23 Logged information is correct. as expected

AO-24 Source is unchanged by acquisition. not checked 

Analysis: Expected results achieved 

June 2008 11 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

5.2.4 DA-06-USB 
 
 Test Case DA-06-USB FTK Imager 2.5.3.14

Case 

Summary: 

DA-06 Acquire a physical device using access interface AI to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source.

AM-02 The tool acquires digital source DS.

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file

on file system type FS.

AM-06 All visible sectors are acquired from the digital source.

AM-08 All sectors acquired from the digital source are acquired accurately.

AO-01 If the tool creates an image file, the data represented by the image

file is the same as the data acquired by the tool.

AO-05 If the tool creates a multi-file image of a requested size then all

the individual files shall be no larger than the requested size.

AO-22 If requested, the tool calculates block hashes for a specified block

size during an acquisition for each block acquired from the digital source.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file.

AO-24 If the tool executes in a forensically safe execution environment,

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 

Test Host: Freddy

Test Date: Wed Oct 31 14:04:06 2007 

Drives: src(01-IDE) dst (none) other (01-FU)

Source src hash (SHA1): < A48BB5665D6DC57C22DB68E2F723DA9AA8DF82B9 >

Setup: src hash (MD5): < F458F673894753FA6A0EC8B8EC63848E >

78165360 total sectors (40020664320 bytes)

Model (0BB-00JHC0 ) serial # ( WD-WMAMC74171)

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

2 X 020980890 057175335 1023/000/01 1023/254/63 0F extended 

3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap

14 x 029431080 027744255 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027744192 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

1 020980827 sectors 10742183424 bytes

3 000032067 sectors 16418304 bytes

5 002104452 sectors 1077479424 bytes

7 004192902 sectors 2146765824 bytes

9 008401932 sectors 4301789184 bytes

11 010490382 sectors 5371075584 bytes

13 004208967 sectors 2154991104 bytes

15 027744192 sectors 14205026304 bytes 

Log

Highlights: 

Created By AccessData® FTK® Imager 2.5.3.14 071018

Sector Count: 78,165,360

Source data size: 38166 MB 

MD5 checksum: f458f673894753fa6a0ec8b8ec63848e 

SHA1 checksum: a48bb5665d6dc57c22db68e2f723da9aa8df82b9 

Acquisition started: Wed Oct 31 14:12:35 2007 

Acquisition finished: Thu Nov 01 06:38:02 2007 

Verification started: Thu Nov 01 06:38:02 2007 

Verification finished: Thu Nov 01 06:44:11 2007 

MD5 checksum: f458f673894753fa6a0ec8b8ec63848e : verified 

June 2008 12 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

Test Case DA-06-USB FTK Imager 2.5.3.14

SHA1 checksum: a48bb5665d6dc57c22db68e2f723da9aa8df82b9 : verified 

Settings: size CD(640MB)

Write Block: 31 Tableau UltraBlock IDE 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected

AM-02 Source is type DS. as expected

AM-03 Execution environment is XE. as expected

AM-05 An image is created on file system type FS. as expected

AM-06 All visible sectors acquired. as expected

AM-08 All sectors accurately acquired. as expected

AO-01 Image file is complete and accurate. as expected

AO-05 Multifile image created. as expected

AO-22 Tool calculates hashes by block. option not available

AO-23 Logged information is correct. as expected

AO-24 Source is unchanged by acquisition. not checked 

Analysis: Expected results achieved 

June 2008 13 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

5.2.5 DA-07-CF 
 
 Test Case DA-07-CF FTK Imager 2.5.3.14

Case DA-07 Acquire a digital source of type DS to an image file.

Summary:

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source.

AM-02 The tool acquires digital source DS.

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file on

file system type FS.

AM-06 All visible sectors are acquired from the digital source.

AM-08 All sectors acquired from the digital source are acquired accurately.

AO-01 If the tool creates an image file, the data represented by the image

file is the same as the data acquired by the tool.

AO-05 If the tool creates a multi-file image of a requested size then all

the individual files shall be no larger than the requested size.

AO-22 If requested, the tool calculates block hashes for a specified block

size during an acquisition for each block acquired from the digital source.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file.

AO-24 If the tool executes in a forensically safe execution environment, the

digital source is unchanged by the acquisition process. 

Tester mrmw 

Name: 

Test Host: Frank 

Test Date: Wed Oct 31 10:48:24 2007 

Drives: src(C1-CF) dst (none) other (06-FU)

Source src hash (SHA256): <

Setup: C7CF0218222DF80D5316511D6814266C7FA507C13F795AD3D323BB73C1590D80 > 

src hash (SHA1): < 5B8235178DF99FA307430C088F81746606638A0B >

src hash (MD5): < 776DF8B4D2589E21DEBCF589EDC16D78 >

503808 total sectors (257949696 bytes)

Model ( CF) serial # ()

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 778135908 1141509631 0357/116/40 0357/032/45 Boot 72 other

2 P 168689522 1936028240 0288/115/43 0367/114/50 Boot 65 other

3 P 1869881465 1936028192 0366/032/33 0357/032/43 Boot 79 other

4 P 2885681152 000055499 0372/097/50 0000/010/00 Boot 0D other

1 1141509631 sectors 584452931072 bytes

2 1936028240 sectors 991246458880 bytes

3 1936028192 sectors 991246434304 bytes

4 000055499 sectors 28415488 bytes 

Log Created By AccessData® FTK® Imager 2.5.3.14 071018

Highlights: Sector Count: 503,808

Source data size: 246 MB 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b 

Acquisition started: Tue Oct 30 17:50:36 2007 

Acquisition finished: Tue Oct 30 17:51:39 2007 

Verification started: Tue Oct 30 17:51:39 2007 

Verification finished: Tue Oct 30 17:51:41 2007 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 : verified 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b : verified 

Settings: CD (640MB)

Write Block: 7 Digital Intelligence UltraBlock 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected

AM-02 Source is type DS. as expected

AM-03 Execution environment is XE. as expected

AM-05 An image is created on file system type FS. as expected

AM-06 All visible sectors acquired. as expected

AM-08 All sectors accurately acquired. as expected

AO-01 Image file is complete and accurate. as expected

AO-05 Multifile image created. as expected 

June 2008 14 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

Test Case DA-07-CF FTK Imager 2.5.3.14

AO-22 Tool calculates hashes by block. option not available

AO-23 Logged information is correct. as expected

AO-24 Source is unchanged by acquisition. not checked 

Analysis: Expected results achieved 

June 2008 15 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

5.2.6 DA-07-F12 
 
 Test Case DA-07-F12 FTK Imager 2.5.3.14

Case 

Summary: 

DA-07 Acquire a digital source of type DS to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source.

AM-02 The tool acquires digital source DS.

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file

on file system type FS.

AM-06 All visible sectors are acquired from the digital source.

AM-08 All sectors acquired from the digital source are acquired accurately.

AO-01 If the tool creates an image file, the data represented by the image

file is the same as the data acquired by the tool.

AO-05 If the tool creates a multi-file image of a requested size then all

the individual files shall be no larger than the requested size.

AO-22 If requested, the tool calculates block hashes for a specified block

size during an acquisition for each block acquired from the digital source.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file.

AO-24 If the tool executes in a forensically safe execution environment,

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 

Test Host: Frank 

Test Date: Thu Nov 1 07:05:48 2007 

Drives: src(01-IDE) dst (none) other (06-FU)

Source src hash (SHA1): < A48BB5665D6DC57C22DB68E2F723DA9AA8DF82B9 >

Setup: src hash (MD5): < F458F673894753FA6A0EC8B8EC63848E >

78165360 total sectors (40020664320 bytes)

Model (0BB-00JHC0 ) serial # ( WD-WMAMC74171)

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

2 X 020980890 057175335 1023/000/01 1023/254/63 0F extended 

3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap

14 x 029431080 027744255 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027744192 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

1 020980827 sectors 10742183424 bytes

3 000032067 sectors 16418304 bytes

5 002104452 sectors 1077479424 bytes

7 004192902 sectors 2146765824 bytes

9 008401932 sectors 4301789184 bytes

11 010490382 sectors 5371075584 bytes

13 004208967 sectors 2154991104 bytes

15 027744192 sectors 14205026304 bytes

01F12-md5 16418303 E20E3CFEA80BF6F2D2AA75E829CC8CD9 

01F12-sha1 16418303 F8B72B65436DE3BD394ACFF71D405D0389C0E9B7 

Log

Highlights: 

Created By AccessData® FTK® Imager 2.5.3.14 071018

Sector Count: 32,067

Source data size: 15 MB 

MD5 checksum: e20e3cfea80bf6f2d2aa75e829cc8cd9 

SHA1 checksum: f8b72b65436de3bd394acff71d405d0389c0e9b7 

Acquisition started: Wed Oct 31 14:11:57 2007 

Acquisition finished: Wed Oct 31 14:11:58 2007 

Verification started: Wed Oct 31 14:11:58 2007 

June 2008 16 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

Test Case DA-07-F12 FTK Imager 2.5.3.14

Verification finished: Wed Oct 31 14:11:58 2007 

MD5 checksum: e20e3cfea80bf6f2d2aa75e829cc8cd9 : verified 

SHA1 checksum: f8b72b65436de3bd394acff71d405d0389c0e9b7 : verified 

Settings: size CD (640 MB)

Write Block: 32 Tableau WriteBlocker 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected

AM-02 Source is type DS. as expected

AM-03 Execution environment is XE. as expected

AM-05 An image is created on file system type FS. as expected

AM-06 All visible sectors acquired. as expected

AM-08 All sectors accurately acquired. as expected

AO-01 Image file is complete and accurate. as expected

AO-05 Multifile image created. as expected

AO-22 Tool calculates hashes by block. option not available

AO-23 Logged information is correct. as expected

AO-24 Source is unchanged by acquisition. not checked 

Analysis: Expected results achieved 

June 2008 17 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

5.2.7 DA-07-F16 
 
 Test Case DA-07-F16 FTK Imager 2.5.3.14

Case 

Summary: 

DA-07 Acquire a digital source of type DS to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source.

AM-02 The tool acquires digital source DS.

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file

on file system type FS.

AM-06 All visible sectors are acquired from the digital source.

AM-08 All sectors acquired from the digital source are acquired accurately.

AO-01 If the tool creates an image file, the data represented by the image

file is the same as the data acquired by the tool.

AO-05 If the tool creates a multi-file image of a requested size then all

the individual files shall be no larger than the requested size.

AO-22 If requested, the tool calculates block hashes for a specified block

size during an acquisition for each block acquired from the digital source.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file.

AO-24 If the tool executes in a forensically safe execution environment,

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 

Test Host: Freddy

Test Date: Thu Nov 1 07:08:02 2007 

Drives: src(43) dst (none) other (06-FU)

Source src hash (SHA1): < 888E2E7F7AD237DC7A732281DD93F325065E5871 >

Setup: src hash (MD5): < BC39C3F7EE7A50E77B9BA1E65A5AEEF7 >

78125000 total sectors (40000000000 bytes)

Model (0BB-75JHC0 ) serial # ( WD-WMAMC46588)

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

2 X 020980890 057143205 1023/000/01 1023/254/63 0F extended 

3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap

14 x 029431080 027712125 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027712062 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

1 020980827 sectors 10742183424 bytes

3 000032067 sectors 16418304 bytes

5 002104452 sectors 1077479424 bytes

7 004192902 sectors 2146765824 bytes

9 008401932 sectors 4301789184 bytes

11 010490382 sectors 5371075584 bytes

13 004208967 sectors 2154991104 bytes

15 027712062 sectors 14188575744 bytes

43F16-md5sum 1077479423 37E81FFB31C3CB38AA48B2237500908E 

Log

Highlights: 

Created By AccessData® FTK® Imager 2.5.3.14 071018

Sector Count: 2,104,452

Source data size: 1027 MB 

MD5 checksum: 37e81ffb31c3cb38aa48b2237500908e 

SHA1 checksum: 443ccec9a22f726daf6ce384817151c83b3ebc8b 

Acquisition started: Thu Nov 01 07:13:18 2007 

Acquisition finished: Thu Nov 01 07:14:27 2007 

Verification started: Thu Nov 01 07:14:27 2007 

Verification finished: Thu Nov 01 07:14:36 2007 

June 2008 18 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

Test Case DA-07-F16 FTK Imager 2.5.3.14

MD5 checksum: 37e81ffb31c3cb38aa48b2237500908e : verified 

SHA1 checksum: 443ccec9a22f726daf6ce384817151c83b3ebc8b : verified 

Settings: size FAT (2000MB)

Write Block: 31 Tableau WriteBlock 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected

AM-02 Source is type DS. as expected

AM-03 Execution environment is XE. as expected

AM-05 An image is created on file system type FS. as expected

AM-06 All visible sectors acquired. as expected

AM-08 All sectors accurately acquired. as expected

AO-01 Image file is complete and accurate. as expected

AO-05 Multifile image created. as expected

AO-22 Tool calculates hashes by block. option not available

AO-23 Logged information is correct. as expected

AO-24 Source is unchanged by acquisition. not checked 

Analysis: Expected results achieved 

June 2008 19 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

5.2.8 DA-07-32 
 
 Test Case DA-07-32 FTK Imager 2.5.3.14

Case 

Summary: 

DA-07 Acquire a digital source of type DS to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source.

AM-02 The tool acquires digital source DS.

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file

on file system type FS.

AM-06 All visible sectors are acquired from the digital source.

AM-08 All sectors acquired from the digital source are acquired accurately.

AO-01 If the tool creates an image file, the data represented by the image

file is the same as the data acquired by the tool.

AO-05 If the tool creates a multi-file image of a requested size then all

the individual files shall be no larger than the requested size.

AO-22 If requested, the tool calculates block hashes for a specified block

size during an acquisition for each block acquired from the digital source.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file.

AO-24 If the tool executes in a forensically safe execution environment,

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 

Test Host: Frank 

Test Date: Thu Nov 1 06:52:55 2007 

Drives: src(01-IDE) dst (none) other (06-FU)

Source src hash (SHA1): < A48BB5665D6DC57C22DB68E2F723DA9AA8DF82B9 >

Setup: src hash (MD5): < F458F673894753FA6A0EC8B8EC63848E >

78165360 total sectors (40020664320 bytes)

Model (0BB-00JHC0 ) serial # ( WD-WMAMC74171)

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

2 X 020980890 057175335 1023/000/01 1023/254/63 0F extended 

3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap

14 x 029431080 027744255 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027744192 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

1 020980827 sectors 10742183424 bytes

3 000032067 sectors 16418304 bytes

5 002104452 sectors 1077479424 bytes

7 004192902 sectors 2146765824 bytes

9 008401932 sectors 4301789184 bytes

11 010490382 sectors 5371075584 bytes

13 004208967 sectors 2154991104 bytes

15 027744192 sectors 14205026304 bytes

01F32-md5 4301789183 BFF7DC64C54339DA2A9D7972C076B514 

01F32-sha1 4301789183 B861D9E999F39750B484FFB693FF69DEC090C6B8 

Log

Highlights: 

Created By AccessData® FTK® Imager 2.5.3.14 071018

Sector Count: 8,401,932

Source data size: 4102 MB 

MD5 checksum: bff7dc64c54339da2a9d7972c076b514 

SHA1 checksum: b861d9e999f39750b484ffb693ff69dec090c6b8 

Acquisition started: Wed Oct 31 13:54:20 2007 

Acquisition finished: Wed Oct 31 13:58:48 2007 

Verification started: Wed Oct 31 13:58:48 2007 

June 2008 20 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

Test Case DA-07-32 FTK Imager 2.5.3.14

Verification finished: Wed Oct 31 13:59:22 2007 

MD5 checksum: bff7dc64c54339da2a9d7972c076b514 : verified 

SHA1 checksum: b861d9e999f39750b484ffb693ff69dec090c6b8 : verified 

Settings: size CD(640MB)

Write Block: 32 Tableau WriteBlocker 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected

AM-02 Source is type DS. as expected

AM-03 Execution environment is XE. as expected

AM-05 An image is created on file system type FS. as expected

AM-06 All visible sectors acquired. as expected

AM-08 All sectors accurately acquired. as expected

AO-01 Image file is complete and accurate. as expected

AO-05 Multifile image created. as expected

AO-22 Tool calculates hashes by block. option not available

AO-23 Logged information is correct. as expected

AO-24 Source is unchanged by acquisition. not checked 

Analysis: Expected results achieved 

June 2008 21 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

5.2.9 DA-07-32X 
 
 Test Case DA-07-32X FTK Imager 2.5.3.14

Case 

Summary: 

DA-07 Acquire a digital source of type DS to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source.

AM-02 The tool acquires digital source DS.

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file

on file system type FS.

AM-06 All visible sectors are acquired from the digital source.

AM-08 All sectors acquired from the digital source are acquired accurately.

AO-01 If the tool creates an image file, the data represented by the image

file is the same as the data acquired by the tool.

AO-05 If the tool creates a multi-file image of a requested size then all

the individual files shall be no larger than the requested size.

AO-22 If requested, the tool calculates block hashes for a specified block

size during an acquisition for each block acquired from the digital source.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file.

AO-24 If the tool executes in a forensically safe execution environment,

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 

Test Host: Freddy

Test Date: Thu Nov 1 06:44:59 2007 

Drives: src(43) dst (none) other (01-FU)

Source src hash (SHA1): < 888E2E7F7AD237DC7A732281DD93F325065E5871 >

Setup: src hash (MD5): < BC39C3F7EE7A50E77B9BA1E65A5AEEF7 >

78125000 total sectors (40000000000 bytes)

Model (0BB-75JHC0 ) serial # ( WD-WMAMC46588)

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

2 X 020980890 057143205 1023/000/01 1023/254/63 0F extended 

3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap

14 x 029431080 027712125 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027712062 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

1 020980827 sectors 10742183424 bytes

3 000032067 sectors 16418304 bytes

5 002104452 sectors 1077479424 bytes

7 004192902 sectors 2146765824 bytes

9 008401932 sectors 4301789184 bytes

11 010490382 sectors 5371075584 bytes

13 004208967 sectors 2154991104 bytes

15 027712062 sectors 14188575744 bytes

43F32x-md5sum 10742183424 5980CB0FA68E9862C65765DF50F00906 

Log

Highlights: 

Created By AccessData® FTK® Imager 2.5.3.14 071018

Sector Count: 20,980,827

Source data size: 10244 MB 

MD5 checksum: 5980cb0fa68e9862c65765df50f00906 

SHA1 checksum: 379c1ac47af956fc8c80389c2a7427a7f8fb4e89 

Acquisition started: Thu Nov 01 06:51:39 2007 

Acquisition finished: Thu Nov 01 07:03:12 2007 

Verification started: Thu Nov 01 07:03:12 2007 

Verification finished: Thu Nov 01 07:04:52 2007 

June 2008 22 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

Test Case DA-07-32X FTK Imager 2.5.3.14

MD5 checksum: 5980cb0fa68e9862c65765df50f00906 : verified 

SHA1 checksum: 379c1ac47af956fc8c80389c2a7427a7f8fb4e89 : verified 

Settings: size FAT(2000MB)

Write Block: 31 Tableau WriteBlocker 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected

AM-02 Source is type DS. as expected

AM-03 Execution environment is XE. as expected

AM-05 An image is created on file system type FS. as expected

AM-06 All visible sectors acquired. as expected

AM-08 All sectors accurately acquired. as expected

AO-01 Image file is complete and accurate. as expected

AO-05 Multifile image created. as expected

AO-22 Tool calculates hashes by block. option not available

AO-23 Logged information is correct. as expected

AO-24 Source is unchanged by acquisition. not checked 

Analysis: Expected results achieved 

June 2008 23 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

5.2.10 DA-07-NTFS 
 
 Test Case DA-07-NTFS FTK Imager 2.5.3.14

Case 

Summary: 

DA-07 Acquire a digital source of type DS to an image file. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source.

AM-02 The tool acquires digital source DS.

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file on

file system type FS.

AM-06 All visible sectors are acquired from the digital source.

AM-08 All sectors acquired from the digital source are acquired accurately.

AO-01 If the tool creates an image file, the data represented by the image

file is the same as the data acquired by the tool.

AO-05 If the tool creates a multi-file image of a requested size then all

the individual files shall be no larger than the requested size.

AO-22 If requested, the tool calculates block hashes for a specified block

size during an acquisition for each block acquired from the digital source.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file.

AO-24 If the tool executes in a forensically safe execution environment, the

digital source is unchanged by the acquisition process. 

Tester 

Name: 

mrmw 

Test Host: Frank 

Test Date: Thu Nov 1 07:16:50 2007 

Drives: src(01-IDE) dst (none) other (06-FU)

Source src hash (SHA1): < A48BB5665D6DC57C22DB68E2F723DA9AA8DF82B9 >

Setup: src hash (MD5): < F458F673894753FA6A0EC8B8EC63848E >

78165360 total sectors (40020664320 bytes)

Model (0BB-00JHC0 ) serial # ( WD-WMAMC74171)

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 000000063 020980827 0000/001/01 1023/254/63 0C Fat32X 

2 X 020980890 057175335 1023/000/01 1023/254/63 0F extended 

3 S 000000063 000032067 1023/001/01 1023/254/63 01 Fat12 

4 x 000032130 002104515 1023/000/01 1023/254/63 05 extended 

5 S 000000063 002104452 1023/001/01 1023/254/63 06 Fat16 

6 x 002136645 004192965 1023/000/01 1023/254/63 05 extended 

7 S 000000063 004192902 1023/001/01 1023/254/63 16 other 

8 x 006329610 008401995 1023/000/01 1023/254/63 05 extended 

9 S 000000063 008401932 1023/001/01 1023/254/63 0B Fat32 

10 x 014731605 010490445 1023/000/01 1023/254/63 05 extended 

11 S 000000063 010490382 1023/001/01 1023/254/63 83 Linux 

12 x 025222050 004209030 1023/000/01 1023/254/63 05 extended 

13 S 000000063 004208967 1023/001/01 1023/254/63 82 Linux swap

14 x 029431080 027744255 1023/000/01 1023/254/63 05 extended 

15 S 000000063 027744192 1023/001/01 1023/254/63 07 NTFS 

16 S 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

17 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

18 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

1 020980827 sectors 10742183424 bytes

3 000032067 sectors 16418304 bytes

5 002104452 sectors 1077479424 bytes

7 004192902 sectors 2146765824 bytes

9 008401932 sectors 4301789184 bytes

11 010490382 sectors 5371075584 bytes

13 004208967 sectors 2154991104 bytes

15 027744192 sectors 14205026304 bytes

01NTFS-md5 14205026303 92B27B30BEE8B0FFBA8C660FA1590D49 

01NTFS-sha1 14205026303 0FBA4C36295CB9622CD815577429C3A588C34D09 

01NTFS-sha256 14205026303 

65FCD168163625E5EB74255B2A981B6F1C9D6259AF8A0851369101986A7ABC09 

Log Created By AccessData® FTK® Imager 2.5.3.14 071018

Highlights: Sector Count: 27,744,184

Source data size: 13546 MB 

MD5 checksum: 28a3a4330007f75b8afa99d38ffcd257 

SHA1 checksum: 8ba9460458775fa535752328d3c2f0938f6923f7 

June 2008 24 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

Test Case DA-07-NTFS FTK Imager 2.5.3.14

Acquisition started: Wed Oct 31 14:17:23 2007 

Acquisition finished: Wed Oct 31 14:31:10 2007 

Verification started: Wed Oct 31 14:31:10 2007 

Verification finished: Wed Oct 31 14:33:01 2007 

MD5 checksum: 28a3a4330007f75b8afa99d38ffcd257 : verified 

SHA1 checksum: 8ba9460458775fa535752328d3c2f0938f6923f7 : verified 

Settings: size CD (640MB)

Write Block: 32 Tableau Write Blocker 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected

AM-02 Source is type DS. as expected

AM-03 Execution environment is XE. as expected

AM-05 An image is created on file system type FS. as expected

AM-06 All visible sectors acquired. eight sectors missed

AM-08 All sectors accurately acquired. as expected

AO-01 Image file is complete and accurate. as expected

AO-05 Multifile image created. as expected

AO-22 Tool calculates hashes by block. option not available

AO-23 Logged information is correct. as expected

AO-24 Source is unchanged by acquisition. not checked 

Analysis: Expected results not achieved 

June 2008 25 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

5.2.11 DA-07-THUMB 
 
 Test Case DA-07-THUMB FTK Imager 2.5.3.14

Case DA-07 Acquire a digital source of type DS to an image file.

Summary:

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source.
 


AM-02 The tool acquires digital source DS.
 


AM-03 The tool executes in execution environment XE. 
 


AM-05 If image file creation is specified, the tool creates an image file
 


on file system type FS.
 


AM-06 All visible sectors are acquired from the digital source.
 


AM-08 All sectors acquired from the digital source are acquired accurately.
 


AO-01 If the tool creates an image file, the data represented by the image
 


file is the same as the data acquired by the tool.
 


AO-05 If the tool creates a multi-file image of a requested size then all
 


the individual files shall be no larger than the requested size.
 


AO-22 If requested, the tool calculates block hashes for a specified block
 


size during an acquisition for each block acquired from the digital source.
 


AO-23 If the tool logs any log significant information, the information is
 


accurately recorded in the log file.
 


AO-24 If the tool executes in a forensically safe execution environment,
 


the digital source is unchanged by the acquisition process. 
 


Tester Name: mrmw 

Test Host: Freddy

Test Date: Wed Oct 31 13:51:39 2007 

Drives: src(D5-thumb) dst (none) other (01-FU)

Source src hash (SHA1): < D68520EF74A336E49DCCF83815B7B08FDC53E38A >

Setup: src hash (MD5): < C843593624B2B3B878596D8760B19954 >

505856 total sectors (258998272 bytes)

Model (usb2.0Flash Disk) serial # ()

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 778135908 1141509631 0357/116/40 0357/032/45 Boot 72 other

2 P 168689522 1936028240 0288/115/43 0367/114/50 Boot 65 other

3 P 1869881465 1936028192 0366/032/33 0357/032/43 Boot 79 other

4 P 2885681152 000055499 0372/097/50 0000/010/00 Boot 0D other

1 1141509631 sectors 584452931072 bytes
 


2 1936028240 sectors 991246458880 bytes
 


3 1936028192 sectors 991246434304 bytes
 


4 000055499 sectors 28415488 bytes 
 


Log Created By AccessData® FTK® Imager 2.5.3.14 071018

Highlights: Sector Count: 505,856

Source data size: 247 MB 

MD5 checksum: c843593624b2b3b878596d8760b19954 

SHA1 checksum: d68520ef74a336e49dccf83815b7b08fdc53e38a 

Acquisition started: Wed Oct 31 13:56:31 2007 

Acquisition finished: Wed Oct 31 14:02:18 2007 

Verification started: Wed Oct 31 14:02:18 2007 

Verification finished: Wed Oct 31 14:02:21 2007 

MD5 checksum: c843593624b2b3b878596d8760b19954 : verified 

SHA1 checksum: d68520ef74a336e49dccf83815b7b08fdc53e38a : verified 

Settings: size CD (640MB)
 


Write Block: 18 Forenisc USB Bridge 
 


Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected

AM-02 Source is type DS. as expected

AM-03 Execution environment is XE. as expected

AM-05 An image is created on file system type FS. as expected

AM-06 All visible sectors acquired. as expected

AM-08 All sectors accurately acquired. as expected

AO-01 Image file is complete and accurate. as expected

AO-05 Multifile image created. as expected

AO-22 Tool calculates hashes by block. option not available

AO-23 Logged information is correct. as expected

AO-24 Source is unchanged by acquisition. not checked 

June 2008 26 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

Test Case DA-07-THUMB FTK Imager 2.5.3.14 

Analysis: Expected results achieved 

June 2008 27 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

 

 

5.2.12 DA-08-ATA28 
 
 Test Case DA-08-ATA28 FTK Imager 2.5.3.14

Case DA-08 Acquire a physical drive with hidden sectors to an image file.

Summary:

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source.

AM-02 The tool acquires digital source DS.

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file

on file system type FS.

AM-06 All visible sectors are acquired from the digital source.

AM-07 All hidden sectors are acquired from the digital source.

AM-08 All sectors acquired from the digital source are acquired accurately.

AO-01 If the tool creates an image file, the data represented by the image

file is the same as the data acquired by the tool.

AO-05 If the tool creates a multi-file image of a requested size then all

the individual files shall be no larger than the requested size.

AO-22 If requested, the tool calculates block hashes for a specified block

size during an acquisition for each block acquired from the digital source.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file.

AO-24 If the tool executes in a forensically safe execution environment,

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 

Test Host: Frank 

Test Date: Tue Oct 30 12:56:18 2007 

Drives: src(42) dst (none) other (06-FU)

Source src hash (SHA1): < 5A75399023056E0EB905082B35F8FAA1DB049229 >

Setup: src hash (MD5): < F4B9AAB24554EEEB2A962BDA554A9252 >

78165360 total sectors (40020664320 bytes)

65534/015/63 (max cyl/hd values)

65535/016/63 (number of cyl/hd)

IDE disk: Model (WDC WD400JB-00JJC0) serial # (WD-WCAMA3958512)

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 000000063 070348572 0000/001/01 1023/254/63 Boot 07 NTFS

2 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

3 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

4 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

1 070348572 sectors 36018468864 bytes 

HPA created 

BIOS, XBIOS and Direct disk geometry Reporter (BXDR)

BXDR 128 /S70000000 /P /fbxdrlog.txt

Setting Maximum Addressable Sector to 70000000

MAS now set to 70000000 

Hashes with HPA in place

md5:9BF3C3DEADE47056A1DDC073C5F6B2E2 

sha1:D76F909482B00767B62C295CADE202F92E61CD2E 

Log Created By AccessData® FTK® Imager 2.5.3.14 071018

Highlights: Sector Count: 70,000,001

Source data size: 34179 MB 

MD5 checksum: 9bf3c3deade47056a1ddc073c5f6b2e2 

SHA1 checksum: d76f909482b00767b62c295cade202f92e61cd2e 

Acquisition started: Tue Oct 30 12:57:06 2007 

Acquisition finished: Tue Oct 30 14:17:13 2007 

Verification started: Tue Oct 30 14:17:13 2007 

Verification finished: Tue Oct 30 14:21:49 2007 

MD5 checksum: 9bf3c3deade47056a1ddc073c5f6b2e2 : verified 

SHA1 checksum: d76f909482b00767b62c295cade202f92e61cd2e : verified 

Settings: CD (640MB)Write Block: 2 NoWrite 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected

AM-02 Source is type DS. as expected

AM-03 Execution environment is XE. as expected 

June 2008 28 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

Test Case DA-08-ATA28 FTK Imager 2.5.3.14

AM-05 An image is created on file system type FS.

AM-06 All visible sectors acquired.

AM-07 All hidden sectors acquired.

AM-08 All sectors accurately acquired.

AO-01 Image file is complete and accurate.

AO-05 Multifile image created.

AO-22 Tool calculates hashes by block.

AO-23 Logged information is correct.

AO-24 Source is unchanged by acquisition. 

as expected

as expected

HPA not acquired

as expected

as expected

as expected

option not available

as expected

not checked 

Analysis: Expected results not achieved 

June 2008 29 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

 

 

5.2.13 DA-08-ATA48 
 
 Test Case DA-08-ATA48 FTK Imager 2.5.3.14

Case DA-08 Acquire a physical drive with hidden sectors to an image file.

Summary:

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source.

AM-02 The tool acquires digital source DS.

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file

on file system type FS.

AM-06 All visible sectors are acquired from the digital source.

AM-07 All hidden sectors are acquired from the digital source.

AM-08 All sectors acquired from the digital source are acquired accurately.

AO-01 If the tool creates an image file, the data represented by the image

file is the same as the data acquired by the tool.

AO-05 If the tool creates a multi-file image of a requested size then all

the individual files shall be no larger than the requested size.

AO-22 If requested, the tool calculates block hashes for a specified block

size during an acquisition for each block acquired from the digital source.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file.

AO-24 If the tool executes in a forensically safe execution environment,

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 

Test Host: Frank 

Test Date: Tue Dec 18 13:08:38 2007 

Drives: src(4B) dst (none) other (01-FU)

Source src hash (SHA1): < F409920836FED76DBB60DEEEF467A6DDED5BF48E >

Setup: src hash (MD5): < B5641B5A594912B4D60518304B1DE698 >

390721968 total sectors (200049647616 bytes)

24320/254/63 (max cyl/hd values)

24321/255/63 (number of cyl/hd)

IDE disk: Model (WDC WD2000JB-00GVC0) serial # (WD-WCAL78252964)

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 000000063 351646722 0000/001/01 1023/254/63 Boot 07 NTFS

2 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

3 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

4 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

1 351646722 sectors 180043121664 bytes 

HPA created 

BIOS, XBIOS and Direct disk geometry Reporter (BXDR)

BXDR 128 /S351000000 /P /fHPA.TXT

Setting Maximum Addressable Sector to 351000000

MAS now set to 351000000 

Hashes with HPA in place

md5:6BAFEFC000470C126434D933429C879B 

sha1:2D50DBD82CD3DA90A6E5BF13B2B40808C40998A1 

Log Created By AccessData® FTK® Imager 2.5.3.14 071018

Highlights: Sector Count: 351,000,001

Source data size: 171386 MB 

MD5 checksum: 6bafefc000470c126434d933429c879b 

SHA1 checksum: 2d50dbd82cd3da90a6e5bf13b2b40808c40998a1 

Acquisition started: Tue Dec 18 13:07:31 2007 

Acquisition finished: Tue Dec 18 14:31:25 2007 

Verification started: Tue Dec 18 14:31:26 2007 

Verification finished: Tue Dec 18 14:56:59 2007 

MD5 checksum: 6bafefc000470c126434d933429c879b : verified 

SHA1 checksum: 2d50dbd82cd3da90a6e5bf13b2b40808c40998a1 : verified 

Settings: CD

Write Block: 4 Guidance Software FastBloc IDE 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected

AM-02 Source is type DS. as expected 

June 2008 30 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

Test Case DA-08-ATA48 FTK Imager 2.5.3.14

AM-03 Execution environment is XE. 

AM-05 An image is created on file system type FS.

AM-06 All visible sectors acquired.

AM-07 All hidden sectors acquired.

AM-08 All sectors accurately acquired.

AO-01 Image file is complete and accurate.

AO-05 Multifile image created.

AO-22 Tool calculates hashes by block.

AO-23 Logged information is correct.

AO-24 Source is unchanged by acquisition. 

as expected

as expected

as expected

HPA not acquired

as expected

as expected

as expected

option not available

as expected

not checked 

Analysis: Expected results not achieved 

June 2008 31 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

 

 

5.2.14 DA-08-DCO 
 
 Test Case DA-08-DCO FTK Imager 2.5.3.14

Case DA-08 Acquire a physical drive with hidden sectors to an image file.

Summary:

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source.

AM-02 The tool acquires digital source DS.

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file

on file system type FS.

AM-06 All visible sectors are acquired from the digital source.

AM-07 All hidden sectors are acquired from the digital source.

AM-08 All sectors acquired from the digital source are acquired accurately.

AO-01 If the tool creates an image file, the data represented by the image

file is the same as the data acquired by the tool.

AO-05 If the tool creates a multi-file image of a requested size then all

the individual files shall be no larger than the requested size.

AO-22 If requested, the tool calculates block hashes for a specified block

size during an acquisition for each block acquired from the digital source.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file.

AO-24 If the tool executes in a forensically safe execution environment,

the digital source is unchanged by the acquisition process. 

Tester Name: mrmw 

Test Host: Frank 

Test Date: Tue Oct 30 14:32:14 2007 

Drives: src(92) dst (none) other (06-FU)

Source src hash (SHA1): < 63E6F7BD3040A8ADA2CF8FBF66A805B76DF10481 >

Setup: src hash (MD5): < E095DD1BD0B0DD6E603153A3FE1A2F3E >

58633344 total sectors (30020272128 bytes)
 

58167/015/63 (max cyl/hd values)
 

58168/016/63 (number of cyl/hd)
 

IDE disk: Model (WDC WD300BB-00CAA0) serial # (WD-WMA8H2140350)
 

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 000000063 058605057 0000/001/01 1023/254/63 Boot 07 NTFS

2 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

3 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

4 P 000000000 000000000 0000/000/00 0000/000/00 00 empty entry

1 058605057 sectors 30005789184 bytes 

Hashes with DCO in place:

md5:525963C6789423396FE1F3202A8CBD04 

sha1.txt:55A3CFE756B7B0034DCCE71F7D7A477D8681B781 

Log Created By AccessData® FTK® Imager 2.5.3.14 071018

Highlights: Sector Count: 52,770,010

Source data size: 25766 MB 

MD5 checksum: 525963c6789423396fe1f3202a8cbd04 

SHA1 checksum: 55a3cfe756b7b0034dcce71f7d7a477d8681b781 

Acquisition started: Mon Oct 29 22:31:15 2007 

Acquisition finished: Mon Oct 29 23:38:18 2007 

Verification started: Mon Oct 29 23:38:18 2007 

Verification finished: Mon Oct 29 23:41:47 2007 

MD5 checksum: 525963c6789423396fe1f3202a8cbd04 : verified 

SHA1 checksum: 55a3cfe756b7b0034dcce71f7d7a477d8681b781 : verified 

Settings: size FAT(2000)Write Block: 2 NoWrite 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected

AM-02 Source is type DS. as expected

AM-03 Execution environment is XE. as expected

AM-05 An image is created on file system type FS. as expected

AM-06 All visible sectors acquired. as expected

AM-07 All hidden sectors acquired. DCO not acquired

AM-08 All sectors accurately acquired. as expected

AO-01 Image file is complete and accurate. as expected 

June 2008 32 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

Test Case DA-08-DCO FTK Imager 2.5.3.14

AO-05 Multifile image created.

AO-22 Tool calculates hashes by block.

AO-23 Logged information is correct.

AO-24 Source is unchanged by acquisition. 

as expected

option not available

as expected

not checked 

Analysis: Expected results not achieved 

June 2008 33 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

5.2.15 DA-09 
 
 Test Case DA-09 FTK Imager 2.5.3.14

Case 

Summary: 

DA-09 Acquire a digital source that has at least one faulty data sector. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source.

AM-02 The tool acquires digital source DS.

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file on

file system type FS.

AM-06 All visible sectors are acquired from the digital source.

AM-08 All sectors acquired from the digital source are acquired accurately.

AM-09 If unresolved errors occur while reading from the selected digital

source, the tool notifies the user of the error type and location within the

digital source.

AM-10 If unresolved errors occur while reading from the selected digital

source, the tool uses a benign fill in the destination object in place of

the inaccessible data. 

AO-01 If the tool creates an image file, the data represented by the image

file is the same as the data acquired by the tool.

AO-05 If the tool creates a multi-file image of a requested size then all

the individual files shall be no larger than the requested size.

AO-22 If requested, the tool calculates block hashes for a specified block

size during an acquisition for each block acquired from the digital source.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file.

AO-24 If the tool executes in a forensically safe execution environment, the

digital source is unchanged by the acquisition process. 

Tester 

Name: 

mrmw 

Test Host: Freddy

Test Date: Tue Oct 30 14:13:22 2007 

Drives: src(ED-BAD-CPR1) dst (none) other (01-FU)

Source No before hash for ED-BAD-CPR1 120103200 total sectors (61492838400 bytes)

Setup: Drive with known bad sectors 

Vendor: Maxtor Model: DiamondMax Plus 9 

Known Bad Sector List for ED-CPR-BAD-1 

Manufacturer: Maxtor 

Model: 6Y060L0 DiamondMax Plus 9 

Serial Number: Y27KR6CE 

Capacity: 60GB

Interface: PATA 

54 faulty sectors

10069095, 10069911, 12023808, 18652594, 18656041, 18656857, 18660303,

18661119, 19746716-19746717, 22233904, 23098370, 23383001, 24102466­

24102467, 24104250, 24106656, 24107458, 28959971-28959972, 41825791,

41828995, 52654580, 52655318, 60522984, 68643842-68643843, 69973290,

72714626, 72715293, 82148809, 82148810, 83810525, 85310861, 85313430,

85314038-85314039, 86321211, 86323780, 87186066, 87856313, 87856922,

97191260-97191261, 100093150-100093151, 103861021, 109706975-109706976,

110347947, 110350122-110350123, 115664758, 115835518 

Log

Highlights: 

Destination setup

156301488 sectors wiped with F0

Created By AccessData® FTK® Imager 2.5.3.14 071018

Sector Count: 120,103,200

Source data size: 58644 MB 

MD5 checksum: ef3e63c324522760c838f2a93b7180d3 

SHA1 checksum: 73c3e7b8b73dc60a04dc1db1463bef57231901df 

Acquisition started: Tue Oct 30 14:19:51 2007 

Acquisition finished: Tue Oct 30 16:34:10 2007 

Verification started: Tue Oct 30 16:34:10 2007 

Verification finished: Tue Oct 30 16:43:30 2007 

MD5 checksum: ef3e63c324522760c838f2a93b7180d3 : verified 

SHA1 checksum: 73c3e7b8b73dc60a04dc1db1463bef57231901df : verified 

June 2008 34 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
Test Case DA-09 FTK Imager 2.5.3.14

Read errors: 
 


ATTENTION: 
 


The following sector(s) on the source drive could not be read:
 


10069095 
 

10069911 
 

12023808 
 

18652594 
 

18656041 
 

18656857 
 

18660303 
 

18661119 
 

19746716 through 19746717
 

22233904 
 

23098370 
 

23383001 
 

24102466 through 24102467
 

24104250 
 

24106656 
 

24107458 
 

28959971 through 28959972
 

41825791 
 

41828995 
 

52654580 
 

52655318 
 

60522984 
 

68643842 through 68643843
 

69973290 
 

72714626 
 

72715293 
 

82148809 through 82148810
 

83810525 
 

85310861 
 

85313430 
 

85314038 through 85314039
 

86321211 
 

86323780 
 

87186066 
 

87856313 
 

87856922 
 

97191260 through 97191261
 

100093150 through 100093151
 

103861021 
 

109706975 through 109706976
 

110347947 
 

110350122 through 110350123
 

115664758 
 

115835518 
 

The contents of these sectors were replaced with zeros in the image.
 

2 different run lengths observed in 44 runs
 

34 runs of length 1
 

10 runs of length 2
 

54 sectors differ 
 

54 zero filled and 0 varying non-zero filled
 

Settings: CD (640MB)Write Block: 19 NoWrite 
 

Results: 

Assertion & Expected Result

AM-01 Source acquired using interface AI.
 

AM-02 Source is type DS.
 

AM-03 Execution environment is XE. 
 

AM-05 An image is created on file system type FS.
 

AM-06 All visible sectors acquired.
 

AM-08 All sectors accurately acquired.
 

AM-09 Error logged.
 

AM-10 Benign fill replaces inaccessible sectors.
 

AO-01 Image file is complete and accurate.
 

AO-05 Multifile image created.
 

AO-22 Tool calculates hashes by block.
 

AO-23 Logged information is correct. 
 

Actual Result 

as expected

as expected

as expected

as expected

as expected

as expected

as expected

as expected

as expected

as expected

option not available

as expected 

June 2008 35 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

Test Case DA-09 FTK Imager 2.5.3.14

AO-24 Source is unchanged by acquisition. not checked 

Analysis: Expected results achieved 

June 2008 36 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

 

 

 

5.2.16 DA-10-DD 
 
 Test Case DA-10-DD FTK Imager 2.5.3.14

Case 

Summary: 

DA-10 Acquire a digital source to an image file in an alternate format. 

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source.

AM-02 The tool acquires digital source DS.

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file on

file system type FS.

AM-06 All visible sectors are acquired from the digital source.

AM-08 All sectors acquired from the digital source are acquired accurately.

AO-01 If the tool creates an image file, the data represented by the image

file is the same as the data acquired by the tool.

AO-02 If an image file format is specified, the tool creates an image file

in the specified format.

AO-05 If the tool creates a multi-file image of a requested size then all

the individual files shall be no larger than the requested size.

AO-22 If requested, the tool calculates block hashes for a specified block

size during an acquisition for each block acquired from the digital source.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file.

AO-24 If the tool executes in a forensically safe execution environment, the

digital source is unchanged by the acquisition process. 

Tester 

Name: 

mrmw 

Test Host: Frank 

Test Date: Wed Oct 31 11:01:17 2007 

Drives: src(C1-CF) dst (none) other (06-FU)

Source src hash (SHA256): <

Setup: C7CF0218222DF80D5316511D6814266C7FA507C13F795AD3D323BB73C1590D80 > 

src hash (SHA1): < 5B8235178DF99FA307430C088F81746606638A0B >

src hash (MD5): < 776DF8B4D2589E21DEBCF589EDC16D78 >

503808 total sectors (257949696 bytes)

Model ( CF) serial # ()

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 778135908 1141509631 0357/116/40 0357/032/45 Boot 72 other

2 P 168689522 1936028240 0288/115/43 0367/114/50 Boot 65 other

3 P 1869881465 1936028192 0366/032/33 0357/032/43 Boot 79 other

4 P 2885681152 000055499 0372/097/50 0000/010/00 Boot 0D other

1 1141509631 sectors 584452931072 bytes

2 1936028240 sectors 991246458880 bytes

3 1936028192 sectors 991246434304 bytes

4 000055499 sectors 28415488 bytes 

Log

Highlights: 

Created By AccessData® FTK® Imager 2.5.3.14 071018

Sector Count: 503,808

Source data size: 246 MB 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b 

Acquisition started: Tue Oct 30 18:02:58 2007 

Acquisition finished: Tue Oct 30 18:04:00 2007 

Verification started: Tue Oct 30 18:04:00 2007 

Verification finished: Tue Oct 30 18:04:02 2007 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 : verified 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b : verified 

Verification started: Tue Oct 30 18:49:14 2007 

Verification finished: Tue Oct 30 18:49:16 2007 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 : verified 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b : verified 

Verification started: Tue Oct 30 21:43:15 2007 

Verification finished: Tue Oct 30 21:43:19 2007 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 : verified 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b : verified 

Verification started: Tue Oct 30 21:46:51 2007 

Verification finished: Tue Oct 30 21:46:53 2007 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 : verified 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b : verified 

June 2008 37 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

Test Case DA-10-DD FTK Imager 2.5.3.14

Settings: size CD(640MB)

Write Block: 7 Digital Intelligence UltraBlock 

Results: 

Assertion & Expected Result

AM-01 Source acquired using interface AI.

AM-02 Source is type DS.

AM-03 Execution environment is XE. 

AM-05 An image is created on file system type FS.

AM-06 All visible sectors acquired.

AM-08 All sectors accurately acquired.

AO-01 Image file is complete and accurate.

AO-02 Image file in specified format.

AO-05 Multifile image created.

AO-22 Tool calculates hashes by block.

AO-23 Logged information is correct.

AO-24 Source is unchanged by acquisition. 

Actual Result 

as expected

as expected

as expected

as expected

as expected

as expected

as expected

as expected

as expected

option not available

as expected

not checked 

Analysis: Expected results achieved 

June 2008 38 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

5.2.17 DA-10-SMART 
 
 Test Case DA-10-SMART FTK Imager 2.5.3.14

Case DA-10 Acquire a digital source to an image file in an alternate format.

Summary:

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source.

AM-02 The tool acquires digital source DS.

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file on

file system type FS.

AM-06 All visible sectors are acquired from the digital source.

AM-08 All sectors acquired from the digital source are acquired accurately.

AO-01 If the tool creates an image file, the data represented by the image

file is the same as the data acquired by the tool.

AO-02 If an image file format is specified, the tool creates an image file

in the specified format.

AO-05 If the tool creates a multi-file image of a requested size then all

the individual files shall be no larger than the requested size.

AO-22 If requested, the tool calculates block hashes for a specified block

size during an acquisition for each block acquired from the digital source.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file.

AO-24 If the tool executes in a forensically safe execution environment, the

digital source is unchanged by the acquisition process. 

Tester mrmw 

Name: 

Test Host: Freddy

Test Date: Wed Oct 31 13:36:59 2007 

Drives: src(c1-cf) dst (01-FU) other (none)

Source src hash (SHA256): <

Setup: C7CF0218222DF80D5316511D6814266C7FA507C13F795AD3D323BB73C1590D80 > 

src hash (SHA1): < 5B8235178DF99FA307430C088F81746606638A0B >

src hash (MD5): < 776DF8B4D2589E21DEBCF589EDC16D78 >

503808 total sectors (257949696 bytes)

Model ( CF) serial # ()

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 778135908 1141509631 0357/116/40 0357/032/45 Boot 72 other

2 P 168689522 1936028240 0288/115/43 0367/114/50 Boot 65 other

3 P 1869881465 1936028192 0366/032/33 0357/032/43 Boot 79 other

4 P 2885681152 000055499 0372/097/50 0000/010/00 Boot 0D other

1 1141509631 sectors 584452931072 bytes

2 1936028240 sectors 991246458880 bytes

3 1936028192 sectors 991246434304 bytes

4 000055499 sectors 28415488 bytes 

Log Created By AccessData® FTK® Imager 2.5.3.14 071018

Highlights: Sector Count: 503,808

Source data size: 246 MB 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b 

Acquisition started: Wed Oct 31 13:41:48 2007 

Acquisition finished: Wed Oct 31 13:42:51 2007 

Verification started: Wed Oct 31 13:42:51 2007 

Verification finished: Wed Oct 31 13:42:53 2007 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 : verified 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b : verified 

Settings: size FAT(2000)

Write Block: 7 Digital Intelligence UltraBlock 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected

AM-02 Source is type DS. as expected

AM-03 Execution environment is XE. as expected

AM-05 An image is created on file system type FS. as expected

AM-06 All visible sectors acquired. as expected

AM-08 All sectors accurately acquired. as expected

AO-01 Image file is complete and accurate. as expected 

June 2008 39 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

Test Case DA-10-SMART FTK Imager 2.5.3.14

AO-02 Image file in specified format.
 


AO-05 Multifile image created.
 


AO-22 Tool calculates hashes by block.
 


AO-23 Logged information is correct.
 


AO-24 Source is unchanged by acquisition. 
 


Analysis: Expected results achieved 

as expected

as expected

option not available

as expected

not checked 

June 2008 40 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

5.2.18 DA-12 
 
 Test Case DA-12 FTK Imager 2.5.3.14

Case DA-12 Attempt to create an image file where there is insufficient space.

Summary:

Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source.

AM-02 The tool acquires digital source DS.

AM-03 The tool executes in execution environment XE. 

AM-05 If image file creation is specified, the tool creates an image file on

file system type FS.

AO-04 If the tool is creating an image file and there is insufficient space

on the image destination device to contain the image file, the tool shall

notify the user.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file.

AO-24 If the tool executes in a forensically safe execution environment, the

digital source is unchanged by the acquisition process. 

Tester mrmw 

Name: 

Test Host: Frank 

Test Date: Wed Oct 31 14:58:42 2007 

Drives: src(C1-CF) dst (none) other (06-FU)

Source src hash (SHA256): <

Setup: C7CF0218222DF80D5316511D6814266C7FA507C13F795AD3D323BB73C1590D80 > 

src hash (SHA1): < 5B8235178DF99FA307430C088F81746606638A0B >

src hash (MD5): < 776DF8B4D2589E21DEBCF589EDC16D78 >

503808 total sectors (257949696 bytes)

Model ( CF) serial # ()

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 778135908 1141509631 0357/116/40 0357/032/45 Boot 72 other

2 P 168689522 1936028240 0288/115/43 0367/114/50 Boot 65 other

3 P 1869881465 1936028192 0366/032/33 0357/032/43 Boot 79 other

4 P 2885681152 000055499 0372/097/50 0000/010/00 Boot 0D other

1 1141509631 sectors 584452931072 bytes

2 1936028240 sectors 991246458880 bytes

3 1936028192 sectors 991246434304 bytes

4 000055499 sectors 28415488 bytes 

Log Created By AccessData® FTK® Imager 2.5.3.14 071018

Highlights: Sector Count: 503,808

Source data size: 246 MB 

Acquisition started: Tue Oct 30 22:00:24 2007 

Acquisition finished: Tue Oct 30 22:03:24 2007 

Settings: size 1500 MB

Write Block: 7 Digital Intelligence UltraBlock 

Results: 

Assertion & Expected Result Actual Result 

AM-01 Source acquired using interface AI. as expected

AM-02 Source is type DS. as expected

AM-03 Execution environment is XE. as expected

AM-05 An image is created on file system type FS. as expected

AO-04 User notified if space exhausted. as expected 

June 2008 41 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

Test Case DA-12 FTK Imager 2.5.3.14

AO-23 Logged information is correct. as expected

AO-24 Source is unchanged by acquisition. not checked 

Analysis: Expected results achieved 

June 2008 42 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

 

 

 

 

 

5.2.19 DA-24-DD 
 
 Test Case DA-24-DD FTK Imager 2.5.3.14

Case 

Summary: 

DA-24 Verify a valid image. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-06 If the tool performs an image file integrity check on an image file

that has not been changed since the file was created, the tool shall notify

the user that the image file has not been changed.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file. 

Tester 

Name: 

mrmw 

Test Host: Freddy

Test Date: Mon Nov 5 15:26:10 2007 

Drives: src(C1-CF) dst (06-FU) other (06-FU)

Source src hash (SHA256): <

Setup: C7CF0218222DF80D5316511D6814266C7FA507C13F795AD3D323BB73C1590D80 > 

src hash (SHA1): < 5B8235178DF99FA307430C088F81746606638A0B >

src hash (MD5): < 776DF8B4D2589E21DEBCF589EDC16D78 >

503808 total sectors (257949696 bytes)

Model ( CF) serial # ()

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 778135908 1141509631 0357/116/40 0357/032/45 Boot 72 other

2 P 168689522 1936028240 0288/115/43 0367/114/50 Boot 65 other

3 P 1869881465 1936028192 0366/032/33 0357/032/43 Boot 79 other

4 P 2885681152 000055499 0372/097/50 0000/010/00 Boot 0D other

1 1141509631 sectors 584452931072 bytes

2 1936028240 sectors 991246458880 bytes

3 1936028192 sectors 991246434304 bytes

4 000055499 sectors 28415488 bytes 

Log

Highlights: 

Created By AccessData® FTK® Imager 2.5.3.14 071018

Sector Count: 503,808

Source data size: 246 MB 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b 

Acquisition started: Tue Oct 30 18:02:58 2007 

Acquisition finished: Tue Oct 30 18:04:00 2007 

Verification started: Tue Oct 30 18:04:00 2007 

Verification finished: Tue Oct 30 18:04:02 2007 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 : verified 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b : verified 

Verification started: Tue Oct 30 18:49:14 2007 

Verification finished: Tue Oct 30 18:49:16 2007 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 : verified 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b : verified 

Verification started: Tue Oct 30 21:43:15 2007 

Verification finished: Tue Oct 30 21:43:19 2007 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 : verified 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b : verified 

Verification started: Tue Oct 30 21:46:51 2007 

Verification finished: Tue Oct 30 21:46:53 2007 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 : verified 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b : verified 

Verification started: Mon Nov 05 15:25:32 2007 

Verification finished: Mon Nov 05 15:25:36 2007 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 : verified 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b : verified 

Settings: size 1500 MB 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected

AO-06 Tool verifies image file unchanged. as expected

AO-23 Logged information is correct. as expected 

June 2008 43 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
Test Case DA-24-DD FTK Imager 2.5.3.14

Analysis: Expected results achieved 

June 2008 44 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

5.2.20 DA-25-DD 
 
 Test Case DA-25-DD FTK Imager 2.5.3.14

Case 

Summary: 

DA-25 Detect a corrupted image. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-07 If the tool performs an image file integrity check on an image file

that has been changed since the file was created, the tool shall notify the

user that the image file has been changed.

AO-08 If the tool performs an image file integrity check on an image file

that has been changed since the file was created, the tool shall notify the

user of the affected locations. 

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file. 

Tester 

Name: 

mrmw 

Test Host: Frank 

Test Date: Wed Nov 7 12:26:20 2007 

Drives: src(floppy1) dst (none) other (01-FU)

Source 

Setup: 

src hash (SHA1): < e2863334ac7eaabc7c8a0d62eb0d3b3af29f2c40 >

src hash (MD5): < 17f6a5925be2f38eedaf435ff8b6a6f4 >

Floppy disk

Log

Highlights: 

Image file corrupted for test run:

Change byte 19400 of file da-25-dd.001 from 0x35 to 0x94 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected

AO-07 User notified if image file has changed. as expected

AO-08 User notified of changed locations. User not notified 

AO-23 Logged information is correct. as expected 

Analysis: Expected results not achieved 

June 2008 45 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

 

5.2.21 DA-26-E01-TO-SMART 
 
 Test Case DA-26-E01-TO-SMART FTK Imager 2.5.3.14

Case 

Summary: 

DA-26 Convert an image to an alternate image file format. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-09 If the tool converts a source image file from one format to a target

image file in another format, the acquired data represented in the target

image file is the same as the acquired data in the source image file.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file. 

Tester 

Name: 

mrmw 

Test Host: Freddy

Test Date: Mon Nov 5 14:53:37 2007 

Drives: src(C1-CF) dst (06-FU) other (06-FU)

Source src hash (SHA256): <

Setup: C7CF0218222DF80D5316511D6814266C7FA507C13F795AD3D323BB73C1590D80 > 

src hash (SHA1): < 5B8235178DF99FA307430C088F81746606638A0B >

src hash (MD5): < 776DF8B4D2589E21DEBCF589EDC16D78 >

503808 total sectors (257949696 bytes)

Model ( CF) serial # ()

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 778135908 1141509631 0357/116/40 0357/032/45 Boot 72 other

2 P 168689522 1936028240 0288/115/43 0367/114/50 Boot 65 other

3 P 1869881465 1936028192 0366/032/33 0357/032/43 Boot 79 other

4 P 2885681152 000055499 0372/097/50 0000/010/00 Boot 0D other

1 1141509631 sectors 584452931072 bytes

2 1936028240 sectors 991246458880 bytes

3 1936028192 sectors 991246434304 bytes

4 000055499 sectors 28415488 bytes 

Log

Highlights: 

Created By AccessData® FTK® Imager 2.5.3.14 071018

MD5 verification hash: 776df8b4d2589e21debcf589edc16d78 

Sector Count: 503,808

Operating system: Windows 2003

Source data size: 246 MB 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b 

Acquisition started: Mon Nov 05 14:52:41 2007 

Acquisition finished: Mon Nov 05 14:52:47 2007 

Verification started: Mon Nov 05 14:52:47 2007 

Verification finished: Mon Nov 05 14:52:50 2007 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 : verified 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b : verified 

Settings: size 1500 MB 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected

AO-09 Tool converts image file format. as expected

AO-23 Logged information is correct. as expected 

Analysis: Expected results achieved 

June 2008 46 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

 

5.2.22 DA-26-E01-TO-DD 
 
 Test Case DA-26-E01-TO-DD FTK Imager 2.5.3.14

Case 

Summary: 

DA-26 Convert an image to an alternate image file format. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-09 If the tool converts a source image file from one format to a target

image file in another format, the acquired data represented in the target

image file is the same as the acquired data in the source image file.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file. 

Tester 

Name: 

mrmw 

Test Host: Freddy

Test Date: Mon Nov 5 14:49:59 2007 

Drives: src(C1-CF) dst (06-FU) other (06-FU)

Source src hash (SHA256): <

Setup: C7CF0218222DF80D5316511D6814266C7FA507C13F795AD3D323BB73C1590D80 > 

src hash (SHA1): < 5B8235178DF99FA307430C088F81746606638A0B >

src hash (MD5): < 776DF8B4D2589E21DEBCF589EDC16D78 >

503808 total sectors (257949696 bytes)

Model ( CF) serial # ()

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 778135908 1141509631 0357/116/40 0357/032/45 Boot 72 other

2 P 168689522 1936028240 0288/115/43 0367/114/50 Boot 65 other

3 P 1869881465 1936028192 0366/032/33 0357/032/43 Boot 79 other

4 P 2885681152 000055499 0372/097/50 0000/010/00 Boot 0D other

1 1141509631 sectors 584452931072 bytes

2 1936028240 sectors 991246458880 bytes

3 1936028192 sectors 991246434304 bytes

4 000055499 sectors 28415488 bytes 

Log

Highlights: 

Created By AccessData® FTK® Imager 2.5.3.14 071018

MD5 verification hash: 776df8b4d2589e21debcf589edc16d78 

Sector Count: 503,808

Operating system: Windows 2003

Source data size: 246 MB 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b 

Acquisition started: Mon Nov 05 14:49:18 2007 

Acquisition finished: Mon Nov 05 14:49:23 2007 

Verification started: Mon Nov 05 14:49:23 2007 

Verification finished: Mon Nov 05 14:49:25 2007 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 : verified 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b : verified 

Settings: size 1500 MB 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected

AO-09 Tool converts image file format. as expected

AO-23 Logged information is correct. as expected 

Analysis: Expected results achieved 

June 2008 47 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

 

5.2.23 DA-26-SMART-TO-E01 
 
 Test Case DA-26-SMART-TO-E01 FTK Imager 2.5.3.14

Case 

Summary: 

DA-26 Convert an image to an alternate image file format. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-09 If the tool converts a source image file from one format to a target

image file in another format, the acquired data represented in the target

image file is the same as the acquired data in the source image file.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file. 

Tester 

Name: 

mrmw 

Test Host: Freddy

Test Date: Mon Nov 5 15:06:04 2007 

Drives: src(C1-CF) dst (01-FU) other (01-FU)

Source src hash (SHA256): <

Setup: C7CF0218222DF80D5316511D6814266C7FA507C13F795AD3D323BB73C1590D80 > 

src hash (SHA1): < 5B8235178DF99FA307430C088F81746606638A0B >

src hash (MD5): < 776DF8B4D2589E21DEBCF589EDC16D78 >

503808 total sectors (257949696 bytes)

Model ( CF) serial # ()

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 778135908 1141509631 0357/116/40 0357/032/45 Boot 72 other

2 P 168689522 1936028240 0288/115/43 0367/114/50 Boot 65 other

3 P 1869881465 1936028192 0366/032/33 0357/032/43 Boot 79 other

4 P 2885681152 000055499 0372/097/50 0000/010/00 Boot 0D other

1 1141509631 sectors 584452931072 bytes

2 1936028240 sectors 991246458880 bytes

3 1936028192 sectors 991246434304 bytes

4 000055499 sectors 28415488 bytes 

Log

Highlights: 

Created By AccessData® FTK® Imager 2.5.3.14 071018

MD5 verification hash: 776df8b4d2589e21debcf589edc16d78 

Sector Count: 503,808

Operating system: Windows XP

Source data size: 246 MB 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b 

Acquisition started: Mon Nov 05 15:05:24 2007 

Acquisition finished: Mon Nov 05 15:05:30 2007 

Verification started: Mon Nov 05 15:05:30 2007 

Verification finished: Mon Nov 05 15:05:33 2007 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 : verified 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b : verified 

Settings: size 1500 MB 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected

AO-09 Tool converts image file format. as expected

AO-23 Logged information is correct. as expected 

Analysis: Expected results achieved 

June 2008 48 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

 

5.2.24 DA-26-SMART-TO-DD 
 
 Test Case DA-26-SMART-TO-DD FTK Imager 2.5.3.14

Case 

Summary: 

DA-26 Convert an image to an alternate image file format. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-09 If the tool converts a source image file from one format to a target

image file in another format, the acquired data represented in the target

image file is the same as the acquired data in the source image file.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file. 

Tester 

Name: 

mrmw 

Test Host: Freddy

Test Date: Mon Nov 5 15:02:13 2007 

Drives: src(C1-CF) dst (01-FU) other (01-FU)

Source src hash (SHA256): <

Setup: C7CF0218222DF80D5316511D6814266C7FA507C13F795AD3D323BB73C1590D80 > 

src hash (SHA1): < 5B8235178DF99FA307430C088F81746606638A0B >

src hash (MD5): < 776DF8B4D2589E21DEBCF589EDC16D78 >

503808 total sectors (257949696 bytes)

Model ( CF) serial # ()

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 778135908 1141509631 0357/116/40 0357/032/45 Boot 72 other

2 P 168689522 1936028240 0288/115/43 0367/114/50 Boot 65 other

3 P 1869881465 1936028192 0366/032/33 0357/032/43 Boot 79 other

4 P 2885681152 000055499 0372/097/50 0000/010/00 Boot 0D other

1 1141509631 sectors 584452931072 bytes

2 1936028240 sectors 991246458880 bytes

3 1936028192 sectors 991246434304 bytes

4 000055499 sectors 28415488 bytes 

Log

Highlights: 

Created By AccessData® FTK® Imager 2.5.3.14 071018

MD5 verification hash: 776df8b4d2589e21debcf589edc16d78 

Sector Count: 503,808

Operating system: Windows XP

Source data size: 246 MB 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b 

Acquisition started: Mon Nov 05 15:01:52 2007 

Acquisition finished: Mon Nov 05 15:01:58 2007 

Verification started: Mon Nov 05 15:01:58 2007 

Verification finished: Mon Nov 05 15:02:01 2007 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 : verified 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b : verified 

Settings: size 1500 MB 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected

AO-09 Tool converts image file format. as expected

AO-23 Logged information is correct. as expected 

Analysis: Expected results achieved 

June 2008 49 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

 

5.2.25 DA-26-DD-TO-E01 
 
 Test Case DA-26-DD-TO-E01 FTK Imager 2.5.3.14

Case 

Summary: 

DA-26 Convert an image to an alternate image file format. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-09 If the tool converts a source image file from one format to a target

image file in another format, the acquired data represented in the target

image file is the same as the acquired data in the source image file.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file. 

Tester 

Name: 

mrmw 

Test Host: Freddy

Test Date: Mon Nov 5 14:40:28 2007 

Drives: src(C1-CF) dst (06-FU) other (06-FU)

Source src hash (SHA256): <

Setup: C7CF0218222DF80D5316511D6814266C7FA507C13F795AD3D323BB73C1590D80 > 

src hash (SHA1): < 5B8235178DF99FA307430C088F81746606638A0B >

src hash (MD5): < 776DF8B4D2589E21DEBCF589EDC16D78 >

503808 total sectors (257949696 bytes)

Model ( CF) serial # ()

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 778135908 1141509631 0357/116/40 0357/032/45 Boot 72 other

2 P 168689522 1936028240 0288/115/43 0367/114/50 Boot 65 other

3 P 1869881465 1936028192 0366/032/33 0357/032/43 Boot 79 other

4 P 2885681152 000055499 0372/097/50 0000/010/00 Boot 0D other

1 1141509631 sectors 584452931072 bytes

2 1936028240 sectors 991246458880 bytes

3 1936028192 sectors 991246434304 bytes

4 000055499 sectors 28415488 bytes 

Log

Highlights: 

Created By AccessData® FTK® Imager 2.5.3.14 071018

Sector Count: 503,808

Source data size: 246 MB 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b 

Acquisition started: Mon Nov 05 14:42:19 2007 

Acquisition finished: Mon Nov 05 14:42:24 2007 

Verification started: Mon Nov 05 14:42:24 2007 

Verification finished: Mon Nov 05 14:42:26 2007 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 : verified 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b : verified 

Settings: size 1500 MB 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected

AO-09 Tool converts image file format. as expected

AO-23 Logged information is correct. as expected 

Analysis: Expected results achieved 

June 2008 50 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
 

 

 

 

 

5.2.26 DA-26-DD-TO-SMART 
 
 Test Case DA-26-DD-TO-SMART FTK Imager 2.5.3.14

Case 

Summary: 

DA-26 Convert an image to an alternate image file format. 

Assertions: AM-03 The tool executes in execution environment XE. 

AO-09 If the tool converts a source image file from one format to a target

image file in another format, the acquired data represented in the target

image file is the same as the acquired data in the source image file.

AO-23 If the tool logs any log significant information, the information is

accurately recorded in the log file. 

Tester 

Name: 

mrmw 

Test Host: Freddy

Test Date: Mon Nov 5 14:47:19 2007 

Drives: src(C1-CF) dst (06-FU) other (06-FU)

Source src hash (SHA256): <

Setup: C7CF0218222DF80D5316511D6814266C7FA507C13F795AD3D323BB73C1590D80 > 

src hash (SHA1): < 5B8235178DF99FA307430C088F81746606638A0B >

src hash (MD5): < 776DF8B4D2589E21DEBCF589EDC16D78 >

503808 total sectors (257949696 bytes)

Model ( CF) serial # ()

N Start LBA Length Start C/H/S End C/H/S boot Partition type

1 P 778135908 1141509631 0357/116/40 0357/032/45 Boot 72 other

2 P 168689522 1936028240 0288/115/43 0367/114/50 Boot 65 other

3 P 1869881465 1936028192 0366/032/33 0357/032/43 Boot 79 other

4 P 2885681152 000055499 0372/097/50 0000/010/00 Boot 0D other

1 1141509631 sectors 584452931072 bytes

2 1936028240 sectors 991246458880 bytes

3 1936028192 sectors 991246434304 bytes

4 000055499 sectors 28415488 bytes 

Log

Highlights: 

Created By AccessData® FTK® Imager 2.5.3.14 071018

Sector Count: 503,808

Source data size: 246 MB 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b 

Acquisition started: Mon Nov 05 14:45:22 2007 

Acquisition finished: Mon Nov 05 14:45:28 2007 

Verification started: Mon Nov 05 14:45:28 2007 

Verification finished: Mon Nov 05 14:45:30 2007 

MD5 checksum: 776df8b4d2589e21debcf589edc16d78 : verified 

SHA1 checksum: 5b8235178df99fa307430c088f81746606638a0b : verified 

Settings: size 1500 MB 

Results: 

Assertion & Expected Result Actual Result 

AM-03 Execution environment is XE. as expected

AO-09 Tool converts image file format. as expected

AO-23 Logged information is correct. as expected 

Analysis: Expected results achieved 

June 2008 51 of 51 Results of FTK Imager 2.5.3.14 3/3/2008 
About the National Institute of Justice 

NIJ is the research, development, and evaluation agency of the U.S. Department of Justice. NIJ’s 

mission is to advance scientific research, development, and evaluation to enhance the administration of justice and public safety. NIJ’s principal authorities are derived from the Omnibus 

Crime Control and Safe Streets Act of 1968, as amended (see 42 U.S.C. §§ 3721–3723). 

The NIJ Director is appointed by the President and confirmed by the Senate. The Director establishes the Institute’s objectives, guided by the priorities of the Office of Justice Programs, the 

U.S. Department of Justice, and the needs of the field. The Institute actively solicits the views of 

criminal justice and other professionals and researchers to inform its search for the knowledge 

and tools to guide policy and practice. 

Strategic Goals 

NIJ has seven strategic goals grouped into three categories: 

Creating relevant knowledge and tools 

1. Partner with State and local practitioners and policymakers to identify social science research 

and technology needs. 

2. Create scientific, relevant, and reliable knowledge—with a particular emphasis on terrorism, 

violent crime, drugs and crime, cost-effectiveness, and community-based efforts—to enhance 

the administration of justice and public safety. 

3. Develop affordable and effective tools and technologies to enhance the administration of 

justice and public safety. 

Dissemination 

4. Disseminate relevant knowledge and information to practitioners and policymakers in an 

understandable, timely, and concise manner. 

5. Act as an honest broker to identify the information, tools, and technologies that respond to 

the needs of stakeholders. 

Agency management 

6. Practice fairness and openness in the research and development process. 

7. Ensure professionalism, excellence, accountability, cost-effectiveness, and integrity in the 

management and conduct of NIJ activities and programs. 

Program Areas 

In addressing these strategic challenges, the Institute is involved in the following program areas: 

crime control and prevention, including policing; drugs and crime; justice systems and offender 

behavior, including corrections; violence and victimization; communications and information 

technologies; critical incident response; investigative and forensic sciences, including DNA; lessthan-lethal technologies; officer protection; education and training technologies; testing and 

standards; technology assistance to law enforcement and corrections agencies; field testing of 

promising programs; and international crime control. 

In addition to sponsoring research and development and technology assistance, NIJ evaluates 

programs, policies, and technologies. NIJ communicates its research and evaluation findings 

through conferences and print and electronic media. 

To find out more about the National 

Institute of Justice, please visit: 

http://www.ojp.usdoj.gov/nij

or contact: 

National Criminal Justice 

Reference Service 

P.O. Box 6000 

Rockville, MD 20849–6000 

800–851–3420 

http://www.ncjrs.gov