Test Results for Disk Imaging Tools: dd Provided with FreeBSD 4.4

• NCJ Number: 203095
• Date Published: January 2004
• Length: 60 pages
• Grant Number(s): 94-IJ-R-004
• Agencies: NIJ
• Publication Type: Measurement/Evaluation Device

Annotation

This report presents results of an evaluation testing of a commonly used disk imaging tool, the dd execution environment utility provided with FreeBSD 4.4.

Abstract

The objective of the Computer Forensics Tool Testing (CFTT) project is to provide evidence-based assurance that the tools used in computer forensic investigations can be relied on for accurate results. Test results from evaluation testing provide developers with the information necessary to improve technological tools and improve the users understanding of the tools’ capabilities. This report provides data from the testing of a commonly used disk imaging tool: dd as provided with FreeBSD 4.4, tested against Disk Imaging Tool Specification, Version 3.1.6, which was developed by the CFTT staff. This specification identifies four top-level disk imaging tool requirements: (1) the tool should make a bit-stream duplicate or an image of an original disk or partition; (2) the tool should not alter the original disk; (3) the tool should log I/O errors; and (4) the tool’s documentation should be correct. The report presents a results summary by these four requirements, which indicate no major problems with dd as provided with FreeBSD 4.4 in meeting all of the requirements, except the third requirement, which does not apply to dd. The selection process for including test cases is documented, followed by the results of the dd testing grouped by assertion, including optional assertions. The testing environment, hard disk drives, test configurations, software support, and the basic structure of test cases are reviewed. Finally, the report provides a test results summary key, followed by interpretations of the test results and test result summaries. Tables