At work we’re going for the ISO 17025 certification. As part of this I have been verifying and testing tools for a few weeks. This has involved creating a set hard drive containing sample evidence and using my forensic tools (both hardware and software) against that drive and subsequent images.
The most recent tests have involved testing imaging software. I need to make sure that this is accurate and that each forensic tool acquires the same data and produce the same acquisition and verification hash. I thought I’d share my results as they may of interest to you. The software I have been using for acquiring hard drives is Tableau Imager, FTK Imager 3, and EnCase 6.17. My computer in an HP z600 with two quad-core Xeon processors an 12GB RAM. My OS is Windows 7. I have a Tableau T3458is Forensic Bridge installed attached via FireWire 800.
I started with a 320GB laptop hard drive, wiped it, and installed an OS. I then used it to generate some artefacts. When finished it had around 12GB of allocated space, so not a great deal, but enough for testing purposes. Each piece of software was set to full compression.
First up was Tableau Imager version 1.1. It acquired the drive in one hour and fourteen minutes. I wondered if this was wrong as that makes it about 4GB/minute in acquiring speed.
Next up was FTK Imager version 3. That acquired the same drive in three hours and forty-seven minutes. Quite a long time, I thought, but the hash was exactly the same as Tableau Imager.
Finally was EnCase 6.17. This acquired the hard drive in one hour and fifty-one minutes. Same hash value.
So, what does this mean? It kills me to say it but the Guidance products way outperformed FTK Imager. Would this have changed if the drive was completely full? I’ll find out in the future when I run more tests. I like FTK Imager, I still think it is one of the best pieces of software out there as it is full of other features and is still available for free.
I knew that TIM (Tableau Imager) was quick when used with a Tableau write-blocker but I didn’t expect it to image that quickly. I think that this will, at least temporarily, become my tool of choice for acquisitions. I very much doubt that it’ll be the same story when used with a different brand of write-blocker but it is still impressive. However my heart still belongs to FTK Imager.
It should be noted that the compression used on each piece of software was exactly the same. Each produced the same size image.