Test Results for Digital Data Acquisition Tool: X-Ways Forensics 14.8

• NCJ Number: 236224
• Date Published: March 2013
• Length: 117 pages
• Grant Number(s): 2003-IJ-R-029
• Agencies: NIJ
• Publication Type: Report (Technical Assistance)

Annotation

This document reports the results from testing X-Ways Forensics version 14.8 against the Digital Data Acquisition Tool Assertions and Test Plan Version 1.0.

Abstract

Results indicate that the tool acquired source drives completely and accurately except for the cases where source drives containing faulty sectors were imaged; a logical NTFS partition was imaged; or a source drive containing hidden sectors, a Host Protected Area (HPA), or Device Configuration Overlay (DCO) was imaged. The tool restored image files and created clones accurately except for clone or restore operations on certain partitions and removable media where small changes to file system metadata were observed. This report is divided into five sections. The first section is a summary of the results from the test runs and is sufficient for most readers to assess the suitability of the tool for the intended use. The remaining sections of the report describe how the tests were conducted, discuss any anomalies that were encountered and provide documentation of test case run details that support the report summary. Section 2 gives justification for the selection of test cases from the set of possible cases defined in the test plan for Digital Data Acquisition tools. The test cases are selected, in general, based on features offered by the tool. Section 3 describes in more depth any anomalies summarized in the first section. Section 4 lists hardware and software used to run the test cases, with links to additional information about the items used. Section 5 contains a description of each test case run. The description of each test run lists all test assertions used in the test case, the expected result and the actual result. Tables