±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35279
New Yesterday: 3 Visitors: 146

±Latest Articles

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Webinars

Forensics

Smart Anti-Forensics



Page: 3/12

TESTING

A variety of testing was performed by the author of this paper to understand the circumstances which would cause a modification to the Power_Cycle_Count and the Power_On_Hours SMART attribute values. A Knoppix [8] boot CD was used to boot the author's computer to perform these tests. The ultimate goal was to devise a forensic duplication process which would minimise the modification of these SMART attribute values. Detailed test results and the testing procedures are omitted from this paper for the sake of brevity.

The following hard disks were tested:

· Quantum Fireball ST 3.2GB, model number QUANTUM FIREBALL ST3.2A, ATA Version 3, ATA Standard Unknown, Firmware Version A0F.0800
· Quantum Fireball Plus KX 20.5GB, model number QUANTUM FIREBALLP KX20.5, ATA Version 4, ATA Standard ATA/ATAPI-4 T13 1153D revision 15, Firmware Version A1S.3700
· Seagate Barracuda ATA III 40GB, model number ST340824A, ATA Version 4, ATA Standard Unknown, Firmware Version 3.05
· Western Digital Caviar 45GB, model number WDC WD450AA-00BAA0, ATA Version 4, ATA Standard Unknown, Firmware Version 10.09K11
· IBM Deskstar 41GB, model number IC35L040AVER07-0, ATA Version 5, ATA Standard ATA/ATAPI-5 T13 1321D revision 1, Firmware Version ER4OA44A
· Seagate Barracuda 120GB, model number ST3120026A, ATA Version 6, ATA Standard ATA/ATAPI-6 T13 1410D revision 2, Firmware Version 8.54
· Western Digital Caviar SE 160GB, model number WDC WD1600JB-00GVA0, ATA Version 6, ATA Standard Unknown, Firmware Version 08.02D08

The following hard disks were briefly tested, but were quickly rejected and excluded from the tests since they did not support SMART, which first appeared in the ATA Version 3 specifications:

· Conner Peripherals 425MB, model number CFS425A, ATA Version 1, ATA Standard Unknown, Firmware Version 0.23.
· Seagate Medalist 2113MB, model number ST32140A, ATA Version 1, ATA Standard Unknown, Firmware Version 08.08.01.






Previous Page Previous Page (2/12) - Next Page (4/12) Next Page