U.S. flag
      An official website of the United States government, Department of Justice.
        Here's how you know
      Here's how you know**Official websites use .gov**
            
            A **.gov** website belongs to an official government organization in the United States.
      **Secure .gov websites use HTTPS**
            
            A **lock** (
            A locked padlock
            ) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. Menu

      
        close

            
            
                                              About NIJ
        
                    
  
          About NIJ
      
    
          The NIJ Director
          How NIJ Is Organized
          Mission and Guiding Principles
          Research and Development Process
          Strategic Framework
          Assessments of NIJ
          Annual Reports & Reports to Congress
          Staff Directory
          Funding & Awards
        
                    
  
          Funding & Awards
      
    
          Current Funding
          Forthcoming Funding
          Expired Funding
          Awards: Listing of Funded Projects
          Guidance for Applicants and Awardees
          Fellowship & Student Programs
          Travel Scholarships
          NIJ Challenge Program
          Library & Multimedia
        
                    
  
          Library & Multimedia
      
    
          NIJ Journal
          Podcasts
          Publications Listing
          Multimedia Listing
          Rated Practices on CrimeSolutions
          Rated Programs on CrimeSolutions
          Software & Databases
          Datasets
          Patents
          Topics
        
                    
  
          Topics
      
    
          Article Listing
          Corrections
          Courts
          Crime Prevention
          Crimes
          Drugs and Crime
          Equipment and Technology
          Forensic Sciences
          Youth Justice
          Justice System Reform
          Law Enforcement
          Tribal Crime and Justice
          Victims of Crime
          Events
        
                    
  
          Events
      
    
          NIJ 2024 Research Conference
          Scheduled Events
          On-Demand Events
          Research Meetings & Workshops
          NIJ-Hosted Online Training

                            
                                About
          Contact Us
          Subscribe
          Topics A-Z
                  Share
FacebookXLinkedInRedditPinterestEmail Home
                            Library & Multimedia
 Test Results for Disk Imaging Tools: EnCase 3.20
NCJ Number
              200031

Date Published

June 2003
Length
              100 pages
Annotation
              This document reports the results from testing EnCase 3.20, a commonly used disk imaging tool.
Abstract
              The Computer Forensics Tool Testing (CFTT) project is a joint effort of the National Institute of Justice (NIJ), the National Institute of Standards and Technology (NIST), the U.S. Department of Defense (DOD), the Technical Support Working Group, and other related agencies. The goal of the project is to provide measurable assurance to practitioners, researchers, and other applicable users that the tools used in computer forensics investigations provide accurate results. To accomplish this goal, specifications and test methods for computer forensics tools and subsequent testing of specific tools against those specifications must be developed. This report presents the results from testing EnCase 3.20, a disk imaging tool, against Disk Imaging Tool Specification, Version 3.1.6, developed by CFTT staff. This specification identifies the top-level disk imaging tool requirements as: the tool shall make a bit-stream duplicate or an image of an original disk or partition; the tool shall not alter the original disk; the tool shall log I/O errors; and the tool’s documentation shall be correct. Results of the test against the specification for the requirements include the following: 1) EnCase, with one exception, correctly and completely copied all disk sectors to an image file in the test cases that were run, and with two other exceptions, correctly and completely restored all disk sectors to a destination drive in the test cases that were run; 2) for all the test cases that were run, EnCase never altered the original hard drive; 3) for all the test cases that were run, EnCase always identified image files that had been modified; 4) for test cases that were run, EnCase always logged I/O/ errors; and 5) the tool documentation available was the EnCase Reference Manual, Version 3.0, Revision 3.18, and in some cases the software behavior was not documented or was ambiguous. The following three anomalies were found during the test: BIOS anomaly, logical restore anomaly, and restore size anomaly. These anomalies are described more fully in the report along with criteria for test case selection. Test results for also provided for mandatory assertions listed in the Disk Imaging Tool Specification, Version 3.1.6, as well as for optional assertions listed in the specification. Test result summaries are included at the end of the report. Tables
      
  
          Additional Details
Grant Number(s)
        94-IJ-R-004


  
  
        
  Agencies
        NIJ


  
  
        
  Publication Type
        Report (Study/Research)
    
  
  
Date Published: June 1, 2003
    
          Downloads
        
                      PDF

Side navigation
  

        

  
  
              NIJ Journal
    
      
            
            
            
      Podcasts
    
      
            
            
            
      Publications Listing
    
      
            
            
            
      Multimedia Listing
    
      
            
            
            
      Rated Practices on CrimeSolutions
    
      
            
            
            
      Rated Programs on CrimeSolutions
    
      
            
            
            
      Software & Databases
    
      
            
            
            
      Datasets
    
      
            
            
            
      PatentsRelated Topics
        
                Computer mapping
        Computers
        Criminology
        Equipment and technology
        Evaluation



  
Similar Publications
        
                      Experimental Results on Data Analysis Algorithms for Extracting and Interpreting Edge Feature Data for Duct Tape and Textile Physical Fit Examinations
                  Technical Note – Direct Analysis In Real Time Mass Spectrometry (DART-MS)
                  Attitudes of Reporting Officers Extracted From Incident Reports Can Affect Rape Case Outcomes
 Top

      National Institute of Justice

        
        
                        About NIJ
                    About NIJ
      
    
                  How NIJ Is Organized
      
    
                  NIJ Director
      
    
                  Research Disclaimer
      
    
                  Funding & Awards
                    Funding & Awards Home
      
    
                  Awards Listing
      
    
                  Current Funding
      
    
                  Guidance for Applicants and Awardees
      
    
                  Resources
                    Events
      
    
                  Podcasts
      
    
                  Publications
      
    
                  Topics
      
    
                  Multimedia
      
    
                  Reuse Policy
      
    
                  Contacts
                    Contact NIJ
      
    
                  Staff Directory
      
    
                  Submit a FOIA Request
      
    
                  File a Civil Rights ComplaintFacebook
          
                      X
          
                      YouTube
  

      810 7th St. NW, Washington, D.C. 20531
      
              Secondary Footer link menu
            Accessibility
              Plain Language
              Privacy Policy
              Legal Policies and Disclaimer
              No FEAR Act
              Freedom of Information Act
              USA.gov
              Justice.gov