diff --git a/images/cf128mblin.dd b/images/cf128mblin.dd new file mode 100755 index 0000000..9cfef37 Binary files /dev/null and b/images/cf128mblin.dd differ diff --git a/images/cf128mblin.info b/images/cf128mblin.info new file mode 100755 index 0000000..8a8c9ca --- /dev/null +++ b/images/cf128mblin.info @@ -0,0 +1,112 @@ + +GUYMAGER ACQUISITION INFO FILE +============================== + +Guymager +======== + +Version : 0.8.3-1 +Compilation timestamp: 2016-08-05-15.15.41 +Compiled with : gcc 4.9.2 +libewf version : 20140608 +libguytools version : 2.1.0beta5 +Host name : patrick01 +Domain name : (none) +System : Linux patrick01 4.9.11-1-ARCH #1 SMP PREEMPT Sun Feb 19 13:45:52 UTC 2017 x86_64 + + +Device information +================== +Command executed: bash -c "search="`basename /dev/sdc`: H..t P.......d A..a de.....d" && dmesg | grep -A3 "$search" || echo "No kernel HPA messages for /dev/sdc"" +Information returned: +---------------------------------------------------------------------------------------------------- + No kernel HPA messages for /dev/sdc + +Command executed: bash -c "smartctl -s on /dev/sdc ; smartctl -a /dev/sdc" +Information returned: +---------------------------------------------------------------------------------------------------- + smartctl 6.5 2016-05-07 r4318 [x86_64-linux-4.9.11-1-ARCH] (local build) + Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org + + /dev/sdc: Unknown USB bridge [0x0bda:0x0184 (0x8413)] + Please specify device type with the -d option. + + Use smartctl -h to get a usage summary + + smartctl 6.5 2016-05-07 r4318 [x86_64-linux-4.9.11-1-ARCH] (local build) + Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org + + /dev/sdc: Unknown USB bridge [0x0bda:0x0184 (0x8413)] + Please specify device type with the -d option. + + Use smartctl -h to get a usage summary + +Command executed: bash -c "hdparm -I /dev/sdc" +Information returned: +---------------------------------------------------------------------------------------------------- + SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + + /dev/sdc: + + ATA device, with non-removable media + Standards: + Likely used: 1 + Configuration: + Logical max current + cylinders 0 0 + heads 0 0 + sectors/track 0 0 + -- + Logical/Physical Sector size: 512 bytes + device size with M = 1024*1024: 0 MBytes + device size with M = 1000*1000: 0 MBytes + cache/buffer size = unknown + Capabilities: + IORDY not likely + Cannot perform double-word IO + R/W multiple sector transfer: not supported + DMA: not supported + PIO: pio0 + +Hidden areas: unknown + + +Acquisition +=========== + +Linux device : /dev/sdc +Device size : 128188416 (128,2MB) +Format : Linux split dd raw image - file extension is .xxx +Image path and file name: /home/neupat75/Entwicklung/fatmapper/cf128mblin.xxx +Info path and file name: /home/neupat75/Entwicklung/fatmapper/cf128mblin.info +Hash calculation : MD5 and SHA-1 +Source verification : off +Image verification : on + +No bad sectors encountered during acquisition. +State: Finished successfully + +MD5 hash : 1b927cec90d244aa8b0aa76b1edeb3ea +MD5 hash verified source : -- +MD5 hash verified image : 1b927cec90d244aa8b0aa76b1edeb3ea +SHA1 hash : 7bb98b42c7edcbe6ba4981c6287a3ab6d4b3cd8b +SHA1 hash verified source : -- +SHA1 hash verified image : 7bb98b42c7edcbe6ba4981c6287a3ab6d4b3cd8b +SHA256 hash : -- +SHA256 hash verified source: -- +SHA256 hash verified image : -- +Image verification OK. The image contains exactly the data that was written. + +Acquisition started : 2017-03-01 16:24:46 (ISO format YYYY-MM-DD HH:MM:SS) +Verification started: 2017-03-01 16:25:17 +Ended : 2017-03-01 16:25:18 (0 hours, 0 minutes and 31 seconds) +Acquisition speed : 3.94 MByte/s (0 hours, 0 minutes and 31 seconds) +Verification speed : 122.25 MByte/s (0 hours, 0 minutes and 1 seconds) + + +Generated image files and their MD5 hashes +========================================== + +No MD5 hashes available (configuration parameter CalcImageFileMD5 is off) +MD5 Image file +n/a cf128mblin.000 diff --git a/images/cf128mbmac.dd b/images/cf128mbmac.dd new file mode 100755 index 0000000..766f11d Binary files /dev/null and b/images/cf128mbmac.dd differ diff --git a/images/cf128mbmac.dd.txt b/images/cf128mbmac.dd.txt new file mode 100755 index 0000000..8e3867c --- /dev/null +++ b/images/cf128mbmac.dd.txt @@ -0,0 +1,45 @@ +Created By AccessData® FTK® Imager 3.1.1.8 + +Case Information: +Acquired using: ADI3.1.1.8 +Case Number: 20170301 +Evidence Number: 9 +Unique description: cf128mbmac +Examiner: Patrick Neumann +Notes: fatmapper test device (macOS) + +-------------------------------------------------------------- + +Information for C:\Users\Patrick Neumann\Desktop\cf128mbmac: + +Physical Evidentiary Item (Source) Information: +[Device Info] + Source Type: Physical +[Drive Geometry] + Cylinders: 15 + Tracks per Cylinder: 255 + Sectors per Track: 63 + Bytes per Sector: 512 + Sector Count: 250.368 +[Physical Drive Information] + Drive Model: Generic- Compact Flash USB Device + Drive Serial Number: 20100818841300000 + Drive Interface Type: USB + Removable drive: True + Source data size: 122 MB + Sector count: 250368 +[Computed Hashes] + MD5 checksum: c337e6c43f53d5e82f81f04fec9782c1 + SHA1 checksum: 1178d208d6a3beb0c14ea8e0120c314a7cf16d9e + +Image Information: + Acquisition started: Wed Mar 01 14:54:50 2017 + Acquisition finished: Wed Mar 01 14:55:26 2017 + Segment list: + C:\Users\Patrick Neumann\Desktop\cf128mbmac.001 + +Image Verification Results: + Verification started: Wed Mar 01 14:55:26 2017 + Verification finished: Wed Mar 01 14:55:27 2017 + MD5 checksum: c337e6c43f53d5e82f81f04fec9782c1 : verified + SHA1 checksum: 1178d208d6a3beb0c14ea8e0120c314a7cf16d9e : verified diff --git a/images/cf128mbwin.dd b/images/cf128mbwin.dd new file mode 100755 index 0000000..e66ef38 Binary files /dev/null and b/images/cf128mbwin.dd differ diff --git a/images/cf128mbwin.dd.txt b/images/cf128mbwin.dd.txt new file mode 100755 index 0000000..5b63b2d --- /dev/null +++ b/images/cf128mbwin.dd.txt @@ -0,0 +1,45 @@ +Created By AccessData® FTK® Imager 3.1.1.8 + +Case Information: +Acquired using: ADI3.1.1.8 +Case Number: 20170301 +Evidence Number: 6 +Unique description: cf128mb +Examiner: Patrick Neumann +Notes: fatmapper test device + +-------------------------------------------------------------- + +Information for C:\Users\Patrick Neumann\Desktop\cf128mb: + +Physical Evidentiary Item (Source) Information: +[Device Info] + Source Type: Physical +[Drive Geometry] + Cylinders: 15 + Tracks per Cylinder: 255 + Sectors per Track: 63 + Bytes per Sector: 512 + Sector Count: 250.368 +[Physical Drive Information] + Drive Model: Generic- Compact Flash USB Device + Drive Serial Number: 20100818841300000 + Drive Interface Type: USB + Removable drive: True + Source data size: 122 MB + Sector count: 250368 +[Computed Hashes] + MD5 checksum: 6bdd6a12aedc6f2ac8d1b3aa957978c9 + SHA1 checksum: cc9021f644b3ff6ff04b4cbe44c0d77e17f9bb9f + +Image Information: + Acquisition started: Wed Mar 01 14:31:17 2017 + Acquisition finished: Wed Mar 01 14:31:53 2017 + Segment list: + C:\Users\Patrick Neumann\Desktop\cf128mb.001 + +Image Verification Results: + Verification started: Wed Mar 01 14:31:53 2017 + Verification finished: Wed Mar 01 14:31:54 2017 + MD5 checksum: 6bdd6a12aedc6f2ac8d1b3aa957978c9 : verified + SHA1 checksum: cc9021f644b3ff6ff04b4cbe44c0d77e17f9bb9f : verified diff --git a/images/cf8mblin.dd b/images/cf8mblin.dd new file mode 100755 index 0000000..f112739 Binary files /dev/null and b/images/cf8mblin.dd differ diff --git a/images/cf8mblin.info b/images/cf8mblin.info new file mode 100755 index 0000000..aa527b1 --- /dev/null +++ b/images/cf8mblin.info @@ -0,0 +1,112 @@ + +GUYMAGER ACQUISITION INFO FILE +============================== + +Guymager +======== + +Version : 0.8.3-1 +Compilation timestamp: 2016-08-05-15.15.41 +Compiled with : gcc 4.9.2 +libewf version : 20140608 +libguytools version : 2.1.0beta5 +Host name : patrick01 +Domain name : (none) +System : Linux patrick01 4.9.11-1-ARCH #1 SMP PREEMPT Sun Feb 19 13:45:52 UTC 2017 x86_64 + + +Device information +================== +Command executed: bash -c "search="`basename /dev/sdc`: H..t P.......d A..a de.....d" && dmesg | grep -A3 "$search" || echo "No kernel HPA messages for /dev/sdc"" +Information returned: +---------------------------------------------------------------------------------------------------- + No kernel HPA messages for /dev/sdc + +Command executed: bash -c "smartctl -s on /dev/sdc ; smartctl -a /dev/sdc" +Information returned: +---------------------------------------------------------------------------------------------------- + smartctl 6.5 2016-05-07 r4318 [x86_64-linux-4.9.11-1-ARCH] (local build) + Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org + + /dev/sdc: Unknown USB bridge [0x0bda:0x0184 (0x8413)] + Please specify device type with the -d option. + + Use smartctl -h to get a usage summary + + smartctl 6.5 2016-05-07 r4318 [x86_64-linux-4.9.11-1-ARCH] (local build) + Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org + + /dev/sdc: Unknown USB bridge [0x0bda:0x0184 (0x8413)] + Please specify device type with the -d option. + + Use smartctl -h to get a usage summary + +Command executed: bash -c "hdparm -I /dev/sdc" +Information returned: +---------------------------------------------------------------------------------------------------- + SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + + /dev/sdc: + + ATA device, with non-removable media + Standards: + Likely used: 1 + Configuration: + Logical max current + cylinders 0 0 + heads 0 0 + sectors/track 0 0 + -- + Logical/Physical Sector size: 512 bytes + device size with M = 1024*1024: 0 MBytes + device size with M = 1000*1000: 0 MBytes + cache/buffer size = unknown + Capabilities: + IORDY not likely + Cannot perform double-word IO + R/W multiple sector transfer: not supported + DMA: not supported + PIO: pio0 + +Hidden areas: unknown + + +Acquisition +=========== + +Linux device : /dev/sdc +Device size : 8028160 (8,0MB) +Format : Linux split dd raw image - file extension is .xxx +Image path and file name: /home/neupat75/Entwicklung/fatmapper/cf8mblin.xxx +Info path and file name: /home/neupat75/Entwicklung/fatmapper/cf8mblin.info +Hash calculation : MD5 and SHA-1 +Source verification : off +Image verification : on + +No bad sectors encountered during acquisition. +State: Finished successfully + +MD5 hash : 5099deba212fd5615b190d3e5a1212ae +MD5 hash verified source : -- +MD5 hash verified image : 5099deba212fd5615b190d3e5a1212ae +SHA1 hash : 7e60fd1d939908969a8b685d41522def94c424e0 +SHA1 hash verified source : -- +SHA1 hash verified image : 7e60fd1d939908969a8b685d41522def94c424e0 +SHA256 hash : -- +SHA256 hash verified source: -- +SHA256 hash verified image : -- +Image verification OK. The image contains exactly the data that was written. + +Acquisition started : 2017-03-01 16:13:51 (ISO format YYYY-MM-DD HH:MM:SS) +Verification started: 2017-03-01 16:13:54 +Ended : 2017-03-01 16:13:54 (0 hours, 0 minutes and 2 seconds) +Acquisition speed : 3.83 MByte/s (0 hours, 0 minutes and 2 seconds) +Verification speed : 7.66 MByte/s (0 hours, 0 minutes and 1 seconds) + + +Generated image files and their MD5 hashes +========================================== + +No MD5 hashes available (configuration parameter CalcImageFileMD5 is off) +MD5 Image file +n/a cf8mblin.000 diff --git a/images/cf8mbmac.dd b/images/cf8mbmac.dd new file mode 100755 index 0000000..1717240 Binary files /dev/null and b/images/cf8mbmac.dd differ diff --git a/images/cf8mbmac.dd.txt b/images/cf8mbmac.dd.txt new file mode 100755 index 0000000..9294494 --- /dev/null +++ b/images/cf8mbmac.dd.txt @@ -0,0 +1,45 @@ +Created By AccessData® FTK® Imager 3.1.1.8 + +Case Information: +Acquired using: ADI3.1.1.8 +Case Number: 20170301 +Evidence Number: 7 +Unique description: cf8mbmac +Examiner: Patrick Neumann +Notes: fatmapper test device (macOS) + +-------------------------------------------------------------- + +Information for C:\Users\Patrick Neumann\Desktop\cf8mbmac: + +Physical Evidentiary Item (Source) Information: +[Device Info] + Source Type: Physical +[Drive Geometry] + Cylinders: 15.744 + Tracks per Cylinder: 1 + Sectors per Track: 1 + Bytes per Sector: 512 + Sector Count: 15.744 +[Physical Drive Information] + Drive Model: Generic- Compact Flash USB Device + Drive Serial Number: 20100818841300000 + Drive Interface Type: USB + Removable drive: True + Source data size: 7 MB + Sector count: 15744 +[Computed Hashes] + MD5 checksum: 66bed0a2807ecc7164cf16696b79873f + SHA1 checksum: 358ece8f26ae0f9d12e36f3a854a6c817fb67774 + +Image Information: + Acquisition started: Wed Mar 01 15:38:15 2017 + Acquisition finished: Wed Mar 01 15:38:18 2017 + Segment list: + C:\Users\Patrick Neumann\Desktop\cf8mbmac.001 + +Image Verification Results: + Verification started: Wed Mar 01 15:38:18 2017 + Verification finished: Wed Mar 01 15:38:19 2017 + MD5 checksum: 66bed0a2807ecc7164cf16696b79873f : verified + SHA1 checksum: 358ece8f26ae0f9d12e36f3a854a6c817fb67774 : verified diff --git a/images/cf8mbwin.dd b/images/cf8mbwin.dd new file mode 100755 index 0000000..78c82c7 Binary files /dev/null and b/images/cf8mbwin.dd differ diff --git a/images/cf8mbwin.dd.txt b/images/cf8mbwin.dd.txt new file mode 100755 index 0000000..3608143 --- /dev/null +++ b/images/cf8mbwin.dd.txt @@ -0,0 +1,45 @@ +Created By AccessData® FTK® Imager 3.1.1.8 + +Case Information: +Acquired using: ADI3.1.1.8 +Case Number: 20170301 +Evidence Number: 4 +Unique description: cf8mb +Examiner: Patrick Neumann +Notes: fatmapper test device + +-------------------------------------------------------------- + +Information for C:\Users\Patrick Neumann\Desktop\cf8mb: + +Physical Evidentiary Item (Source) Information: +[Device Info] + Source Type: Physical +[Drive Geometry] + Cylinders: 15.680 + Tracks per Cylinder: 1 + Sectors per Track: 1 + Bytes per Sector: 512 + Sector Count: 15.680 +[Physical Drive Information] + Drive Model: Generic- Compact Flash USB Device + Drive Serial Number: 20100818841300000 + Drive Interface Type: USB + Removable drive: True + Source data size: 7 MB + Sector count: 15680 +[Computed Hashes] + MD5 checksum: abd366789ba7985fef66d5ccc1febdb3 + SHA1 checksum: 11e3f780ffff697b713e479c2965963d0d960147 + +Image Information: + Acquisition started: Wed Mar 01 15:40:54 2017 + Acquisition finished: Wed Mar 01 15:40:57 2017 + Segment list: + C:\Users\Patrick Neumann\Desktop\cf8mb.001 + +Image Verification Results: + Verification started: Wed Mar 01 15:40:57 2017 + Verification finished: Wed Mar 01 15:40:57 2017 + MD5 checksum: abd366789ba7985fef66d5ccc1febdb3 : verified + SHA1 checksum: 11e3f780ffff697b713e479c2965963d0d960147 : verified diff --git a/images/sm32mblin.dd b/images/sm32mblin.dd new file mode 100755 index 0000000..06a5e3b Binary files /dev/null and b/images/sm32mblin.dd differ diff --git a/images/sm32mblin.info b/images/sm32mblin.info new file mode 100755 index 0000000..bbc2911 --- /dev/null +++ b/images/sm32mblin.info @@ -0,0 +1,112 @@ + +GUYMAGER ACQUISITION INFO FILE +============================== + +Guymager +======== + +Version : 0.8.3-1 +Compilation timestamp: 2016-08-05-15.15.41 +Compiled with : gcc 4.9.2 +libewf version : 20140608 +libguytools version : 2.1.0beta5 +Host name : patrick01 +Domain name : (none) +System : Linux patrick01 4.9.11-1-ARCH #1 SMP PREEMPT Sun Feb 19 13:45:52 UTC 2017 x86_64 + + +Device information +================== +Command executed: bash -c "search="`basename /dev/sdd`: H..t P.......d A..a de.....d" && dmesg | grep -A3 "$search" || echo "No kernel HPA messages for /dev/sdd"" +Information returned: +---------------------------------------------------------------------------------------------------- + No kernel HPA messages for /dev/sdd + +Command executed: bash -c "smartctl -s on /dev/sdd ; smartctl -a /dev/sdd" +Information returned: +---------------------------------------------------------------------------------------------------- + smartctl 6.5 2016-05-07 r4318 [x86_64-linux-4.9.11-1-ARCH] (local build) + Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org + + /dev/sdd: Unknown USB bridge [0x0bda:0x0184 (0x8413)] + Please specify device type with the -d option. + + Use smartctl -h to get a usage summary + + smartctl 6.5 2016-05-07 r4318 [x86_64-linux-4.9.11-1-ARCH] (local build) + Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org + + /dev/sdd: Unknown USB bridge [0x0bda:0x0184 (0x8413)] + Please specify device type with the -d option. + + Use smartctl -h to get a usage summary + +Command executed: bash -c "hdparm -I /dev/sdd" +Information returned: +---------------------------------------------------------------------------------------------------- + SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + + /dev/sdd: + + ATA device, with non-removable media + Standards: + Likely used: 1 + Configuration: + Logical max current + cylinders 0 0 + heads 0 0 + sectors/track 0 0 + -- + Logical/Physical Sector size: 512 bytes + device size with M = 1024*1024: 0 MBytes + device size with M = 1000*1000: 0 MBytes + cache/buffer size = unknown + Capabilities: + IORDY not likely + Cannot perform double-word IO + R/W multiple sector transfer: not supported + DMA: not supported + PIO: pio0 + +Hidden areas: unknown + + +Acquisition +=========== + +Linux device : /dev/sdd +Device size : 32768000 (32,8MB) +Format : Linux split dd raw image - file extension is .xxx +Image path and file name: /home/neupat75/Entwicklung/fatmapper/sm32mblin.xxx +Info path and file name: /home/neupat75/Entwicklung/fatmapper/sm32mblin.info +Hash calculation : MD5 and SHA-1 +Source verification : off +Image verification : on + +No bad sectors encountered during acquisition. +State: Finished successfully + +MD5 hash : 7dc7264f3c0e2c99d962e934d8500289 +MD5 hash verified source : -- +MD5 hash verified image : 7dc7264f3c0e2c99d962e934d8500289 +SHA1 hash : 4de63aada61e6db166ef2e1ab60830d6043500a8 +SHA1 hash verified source : -- +SHA1 hash verified image : 4de63aada61e6db166ef2e1ab60830d6043500a8 +SHA256 hash : -- +SHA256 hash verified source: -- +SHA256 hash verified image : -- +Image verification OK. The image contains exactly the data that was written. + +Acquisition started : 2017-03-01 16:19:14 (ISO format YYYY-MM-DD HH:MM:SS) +Verification started: 2017-03-01 16:19:18 +Ended : 2017-03-01 16:19:18 (0 hours, 0 minutes and 4 seconds) +Acquisition speed : 7.81 MByte/s (0 hours, 0 minutes and 4 seconds) +Verification speed : 31.25 MByte/s (0 hours, 0 minutes and 1 seconds) + + +Generated image files and their MD5 hashes +========================================== + +No MD5 hashes available (configuration parameter CalcImageFileMD5 is off) +MD5 Image file +n/a sm32mblin.000 diff --git a/images/sm32mbmac.dd b/images/sm32mbmac.dd new file mode 100755 index 0000000..80c00b7 Binary files /dev/null and b/images/sm32mbmac.dd differ diff --git a/images/sm32mbmac.dd.txt b/images/sm32mbmac.dd.txt new file mode 100755 index 0000000..1d92ab1 --- /dev/null +++ b/images/sm32mbmac.dd.txt @@ -0,0 +1,45 @@ +Created By AccessData® FTK® Imager 3.1.1.8 + +Case Information: +Acquired using: ADI3.1.1.8 +Case Number: 20170301 +Evidence Number: 8 +Unique description: sm32mbmac +Examiner: Patrick Neumann +Notes: fatmapper test device (macOS) + +-------------------------------------------------------------- + +Information for C:\Users\Patrick Neumann\Desktop\sm32mbmac: + +Physical Evidentiary Item (Source) Information: +[Device Info] + Source Type: Physical +[Drive Geometry] + Cylinders: 3 + Tracks per Cylinder: 255 + Sectors per Track: 63 + Bytes per Sector: 512 + Sector Count: 64.000 +[Physical Drive Information] + Drive Model: Generic USB SM Reader USB Device + Drive Serial Number: 058F312D812 + Drive Interface Type: USB + Removable drive: True + Source data size: 31 MB + Sector count: 64000 +[Computed Hashes] + MD5 checksum: 86b7cafaab98751338f6efb817802324 + SHA1 checksum: 5d6ba021d9f6a2ca3aca817ec7cf20e7ee05bf16 + +Image Information: + Acquisition started: Wed Mar 01 14:50:43 2017 + Acquisition finished: Wed Mar 01 14:50:52 2017 + Segment list: + C:\Users\Patrick Neumann\Desktop\sm32mbmac.001 + +Image Verification Results: + Verification started: Wed Mar 01 14:50:52 2017 + Verification finished: Wed Mar 01 14:50:52 2017 + MD5 checksum: 86b7cafaab98751338f6efb817802324 : verified + SHA1 checksum: 5d6ba021d9f6a2ca3aca817ec7cf20e7ee05bf16 : verified diff --git a/images/sm32mbwin.dd b/images/sm32mbwin.dd new file mode 100755 index 0000000..ebd03bd Binary files /dev/null and b/images/sm32mbwin.dd differ diff --git a/images/sm32mbwin.dd.txt b/images/sm32mbwin.dd.txt new file mode 100755 index 0000000..82443e8 --- /dev/null +++ b/images/sm32mbwin.dd.txt @@ -0,0 +1,45 @@ +Created By AccessData® FTK® Imager 3.1.1.8 + +Case Information: +Acquired using: ADI3.1.1.8 +Case Number: 20170301 +Evidence Number: 5 +Unique description: sm32mb +Examiner: Patrick Neumann +Notes: fatmapper test device + +-------------------------------------------------------------- + +Information for C:\Users\Patrick Neumann\Desktop\sm32mb: + +Physical Evidentiary Item (Source) Information: +[Device Info] + Source Type: Physical +[Drive Geometry] + Cylinders: 3 + Tracks per Cylinder: 255 + Sectors per Track: 63 + Bytes per Sector: 512 + Sector Count: 64.000 +[Physical Drive Information] + Drive Model: Generic USB SM Reader USB Device + Drive Serial Number: 058F312D812 + Drive Interface Type: USB + Removable drive: True + Source data size: 31 MB + Sector count: 64000 +[Computed Hashes] + MD5 checksum: a350f05a57e1cd945bda0ed106080f1b + SHA1 checksum: 96a3610c7af62103ee91285db25eb239beff34a4 + +Image Information: + Acquisition started: Wed Mar 01 14:36:15 2017 + Acquisition finished: Wed Mar 01 14:36:24 2017 + Segment list: + C:\Users\Patrick Neumann\Desktop\sm32mb.001 + +Image Verification Results: + Verification started: Wed Mar 01 14:36:24 2017 + Verification finished: Wed Mar 01 14:36:24 2017 + MD5 checksum: a350f05a57e1cd945bda0ed106080f1b : verified + SHA1 checksum: 96a3610c7af62103ee91285db25eb239beff34a4 : verified