Testing Acquisition Hardware Part 2

A few people liked what I wrote the other day so I’m coming back with a couple more tests that I’ve run today. I have acquired the same drive as with the software tools but this time I have done it with the Tableau TD1 and the ImageMaster Solo III. The hard drive is a 320GB SATA Laptop Drive.

The Tableau TD1 acquired the drive in one hour and eleven minutes. This device uses medium/fast compression but still was pretty fast.

The ImageMaster Solo III acquired the drive in four hours and seven minutes. Obviously this is a bit-for-bit DD image so it writes everything unlike the TD1.

More testing will be done with my external Tableau write-blockers soon, and I will give an update then.

Testing Acquisition Software Part 1

At work we’re going for the ISO 17025 certification. As part of this I have been verifying and testing tools for a few weeks. This has involved creating a set hard drive containing sample evidence and using my forensic tools (both hardware and software) against that drive and subsequent images.

The most recent tests have involved testing imaging software. I need to make sure that this is accurate and that each forensic tool acquires the same data and produce the same acquisition and verification hash. I thought I’d share my results as they may of interest to you. The software I have been using for acquiring hard drives is Tableau Imager, FTK Imager 3, and EnCase 6.17. My computer in an HP z600 with two quad-core Xeon processors an 12GB RAM. My OS is Windows 7. I have a Tableau T3458is Forensic Bridge installed attached via FireWire 800.

I started with a 320GB laptop hard drive, wiped it, and installed an OS. I then used it to generate some artefacts. When finished it had around 12GB of allocated space, so not a great deal, but enough for testing purposes. Each piece of software was set to full compression.

First up was Tableau Imager version 1.1. It acquired the drive in one hour and fourteen minutes. I wondered if this was wrong as that makes it about 4GB/minute in acquiring speed.

Next up was FTK Imager version 3. That acquired the same drive in three hours and forty-seven minutes. Quite a long time, I thought, but the hash was exactly the same as Tableau Imager.

Finally was EnCase 6.17. This acquired the hard drive in one hour and fifty-one minutes. Same hash value.

So, what does this mean? It kills me to say it but the Guidance products way outperformed FTK Imager. Would this have changed if the drive was completely full? I’ll find out in the future when I run more tests. I like FTK Imager, I still think it is one of the best pieces of software out there as it is full of other features and is still available for free.

I knew that TIM (Tableau Imager) was quick when used with a Tableau write-blocker but I didn’t expect it to image that quickly. I think that this will, at least temporarily, become my tool of choice for acquisitions. I very much doubt that it’ll be the same story when used with a different brand of write-blocker but it is still impressive. However my heart still belongs to FTK Imager.

EDIT

It should be noted that the compression used on each piece of software was exactly the same. Each produced the same size image.

Episode 33 – Harry Potter and the Advanced Persistent Threat

Today we talk about the increased risk of cyber-terrorism and the possibility of all out cyber-war, the cost of online thievery, and the current state of digital forensic education. We also talk about a complete and total Weiner.