Test Results for Digital Data Acquisition Tool: EnCase Linen 5.05f

• NCJ Number: 221167
• Date Published: January 2008
• Length: 67 pages
• Grant Number(s): 2003-IJ-R-029
• Agencies: NIJ
• Publication Type: Report (Technical)

Annotation

This report presents the results of testing the EnCase Linen Version 5.05f digital data acquisition tool used in computer forensic investigations.

Abstract

Results of the testing indicate that except for two test cases (DA-08 and DA-09) the EnCase Linen Version 5.05f acquired all visible and hidden sectors completely and accurately from the test media. The two exceptions are the following: (1) up to seven sectors contiguous to a defective sector may be replaced by zeros in the acquisition (DA-09-1 and DA-09-2); and (2) the sectors hidden by a device configuration overlay (DCO) are not acquired (DA-08-DCO). The EnCase Linen Version 5.05f is a digital data acquisition tool used in computer forensic investigations. The Computer Forensics Tool Testing (CFTT), a joint project of the U.S. Department of Justice, National Institute of Justice (NIJ), and the National Institute of Standards and Technology's (NIST's) Office of Law Enforcement Standards (OLES) and Information Technology Laboratory (ITL), provides measurable assurance to practitioners, researchers, and others that the tools used in computer forensics investigations provide accurate results. This report presents the results from testing EnCase Linen Version 5.05f against the Digital Data Acquisition Tool Assertions and Test Plan Version 1.0.