8. Expected Results The software correctly creates a physical disk of the known device and contains all known files in addition to unallocated space. The software correctly hashes the physical disk and the MD5 and SHA1 hash of the forensic matches the original MD5 and SHA1 hash of the test media. 9. Test Results The actual results were the expected results. 10. Observations / Concerns None. 11. Limitations None. 12. Test Procedure Acquire a forensic image of logical files without making changes to the – files Place a folder on the forensic computer containing known good files. Create a hash of the entire folder using a known good utility. Launch FTK Imager Lite. Click “File”. Disk Image” or alternatively use the toolbar icon. “Create of a Folder”. “Contents Click “Next”. If a warning appears about the compatibility of logical image files, click to continue. “Yes” Select the source of the evidence by clicking and then navigate to the good test “Browse” folder. Click “Ok”. Click “Finish”. In the Create Image dialog box, ensure that the boxes for images after they are created”, “verify progress statistics”, and create directory listings of all files in the image after they “precalculate are created” are checked. Click “Add”. Enter [Agency Name] unique case number (mandatory), evidence number (mandatory), unique description (optional), examiner (mandatory), notes (optional). “Next”.
8. Expected Results The software correctly creates a physical disk of the known device and contains all known files in addition to unallocated space. The software correctly hashes the physical disk and the MD5 and SHA1 hash of the forensic matches the original MD5 and SHA1 hash of the test media. 9. Test Results The actual results were the expected results. 10. Observations / Concerns None. 11. Limitations None. 12. Test Procedure – Acquire a forensic image of logical files without making changes to the files Place a folder on the forensic computer containing known good files. Create a hash of the entire folder using a known good utility. Launch FTK Imager Lite. Click “File”. “Create Disk Image” or alternatively use the toolbar icon. “Contents of a Folder”. Click “Next”. If a warning appears about the compatibility of logical image files, click “Yes” to continue. Select the source of the evidence by clicking “Browse” and then navigate to the good test folder. Click “Ok”. Click “Finish”. In the Create Image dialog box, ensure that the boxes for “verify images after they are created”, “precalculate progress statistics”, and create directory listings of all files in the image after they are created” are checked. Click “Add”. Enter [Agency Name] unique case number (mandatory), evidence number (mandatory), unique description (optional), examiner (mandatory), notes (optional). “Next”.
CIRT-Validation-Manual-1.docx