Test Results for Digital Data Acquisition Tool: Logicube Forensic Talon (Software Version 2.43)

• NCJ Number: 228981
• Date Published: January 2010
• Length: 71 pages
• Grant Number(s): 2003-IJ-R-029
• Agencies: NIJ
• Publication Type: Test/Measurement; Guideline

Annotation

This report presents the results from testing the Logicube Forensic Talon, software version 2.43, against the Digital Data Acquisition Tool Assertions and Test Plan Version 1.0, available at the Computer Forensics Tool Testing Web site.

Abstract

Except for one test case, the tested tool acquired all visible and hidden sectors completely and accurately from the test media without anomaly. For one test case, DA-01-PCMCIA, data were inaccurately acquired over the PCMCIA interface. In this test case, in which the PCMIA interface was used to acquire a laptop's internal hard drive, the tool did not acquire all sectors accurately; 220,416 sectors were not acquired. In their place, sectors from earlier and later parts of the source as computed by the tool did not match the source drive's reference hash. The report describes the procedure for test case selection, and the testing environment is described. The latter encompasses test computers, support software, and test drive creation and analysis. Procedures and results are reported for each of the 23 test cases conducted.