added a lot of images
This commit is contained in:
parent
8eb9a58938
commit
649e51f3b6
BIN
images/cf128mblin.dd
Executable file
BIN
images/cf128mblin.dd
Executable file
Binary file not shown.
112
images/cf128mblin.info
Executable file
112
images/cf128mblin.info
Executable file
@ -0,0 +1,112 @@
|
|||||||
|
|
||||||
|
GUYMAGER ACQUISITION INFO FILE
|
||||||
|
==============================
|
||||||
|
|
||||||
|
Guymager
|
||||||
|
========
|
||||||
|
|
||||||
|
Version : 0.8.3-1
|
||||||
|
Compilation timestamp: 2016-08-05-15.15.41
|
||||||
|
Compiled with : gcc 4.9.2
|
||||||
|
libewf version : 20140608
|
||||||
|
libguytools version : 2.1.0beta5
|
||||||
|
Host name : patrick01
|
||||||
|
Domain name : (none)
|
||||||
|
System : Linux patrick01 4.9.11-1-ARCH #1 SMP PREEMPT Sun Feb 19 13:45:52 UTC 2017 x86_64
|
||||||
|
|
||||||
|
|
||||||
|
Device information
|
||||||
|
==================
|
||||||
|
Command executed: bash -c "search="`basename /dev/sdc`: H..t P.......d A..a de.....d" && dmesg | grep -A3 "$search" || echo "No kernel HPA messages for /dev/sdc""
|
||||||
|
Information returned:
|
||||||
|
----------------------------------------------------------------------------------------------------
|
||||||
|
No kernel HPA messages for /dev/sdc
|
||||||
|
|
||||||
|
Command executed: bash -c "smartctl -s on /dev/sdc ; smartctl -a /dev/sdc"
|
||||||
|
Information returned:
|
||||||
|
----------------------------------------------------------------------------------------------------
|
||||||
|
smartctl 6.5 2016-05-07 r4318 [x86_64-linux-4.9.11-1-ARCH] (local build)
|
||||||
|
Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org
|
||||||
|
|
||||||
|
/dev/sdc: Unknown USB bridge [0x0bda:0x0184 (0x8413)]
|
||||||
|
Please specify device type with the -d option.
|
||||||
|
|
||||||
|
Use smartctl -h to get a usage summary
|
||||||
|
|
||||||
|
smartctl 6.5 2016-05-07 r4318 [x86_64-linux-4.9.11-1-ARCH] (local build)
|
||||||
|
Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org
|
||||||
|
|
||||||
|
/dev/sdc: Unknown USB bridge [0x0bda:0x0184 (0x8413)]
|
||||||
|
Please specify device type with the -d option.
|
||||||
|
|
||||||
|
Use smartctl -h to get a usage summary
|
||||||
|
|
||||||
|
Command executed: bash -c "hdparm -I /dev/sdc"
|
||||||
|
Information returned:
|
||||||
|
----------------------------------------------------------------------------------------------------
|
||||||
|
SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||||
|
|
||||||
|
/dev/sdc:
|
||||||
|
|
||||||
|
ATA device, with non-removable media
|
||||||
|
Standards:
|
||||||
|
Likely used: 1
|
||||||
|
Configuration:
|
||||||
|
Logical max current
|
||||||
|
cylinders 0 0
|
||||||
|
heads 0 0
|
||||||
|
sectors/track 0 0
|
||||||
|
--
|
||||||
|
Logical/Physical Sector size: 512 bytes
|
||||||
|
device size with M = 1024*1024: 0 MBytes
|
||||||
|
device size with M = 1000*1000: 0 MBytes
|
||||||
|
cache/buffer size = unknown
|
||||||
|
Capabilities:
|
||||||
|
IORDY not likely
|
||||||
|
Cannot perform double-word IO
|
||||||
|
R/W multiple sector transfer: not supported
|
||||||
|
DMA: not supported
|
||||||
|
PIO: pio0
|
||||||
|
|
||||||
|
Hidden areas: unknown
|
||||||
|
|
||||||
|
|
||||||
|
Acquisition
|
||||||
|
===========
|
||||||
|
|
||||||
|
Linux device : /dev/sdc
|
||||||
|
Device size : 128188416 (128,2MB)
|
||||||
|
Format : Linux split dd raw image - file extension is .xxx
|
||||||
|
Image path and file name: /home/neupat75/Entwicklung/fatmapper/cf128mblin.xxx
|
||||||
|
Info path and file name: /home/neupat75/Entwicklung/fatmapper/cf128mblin.info
|
||||||
|
Hash calculation : MD5 and SHA-1
|
||||||
|
Source verification : off
|
||||||
|
Image verification : on
|
||||||
|
|
||||||
|
No bad sectors encountered during acquisition.
|
||||||
|
State: Finished successfully
|
||||||
|
|
||||||
|
MD5 hash : 1b927cec90d244aa8b0aa76b1edeb3ea
|
||||||
|
MD5 hash verified source : --
|
||||||
|
MD5 hash verified image : 1b927cec90d244aa8b0aa76b1edeb3ea
|
||||||
|
SHA1 hash : 7bb98b42c7edcbe6ba4981c6287a3ab6d4b3cd8b
|
||||||
|
SHA1 hash verified source : --
|
||||||
|
SHA1 hash verified image : 7bb98b42c7edcbe6ba4981c6287a3ab6d4b3cd8b
|
||||||
|
SHA256 hash : --
|
||||||
|
SHA256 hash verified source: --
|
||||||
|
SHA256 hash verified image : --
|
||||||
|
Image verification OK. The image contains exactly the data that was written.
|
||||||
|
|
||||||
|
Acquisition started : 2017-03-01 16:24:46 (ISO format YYYY-MM-DD HH:MM:SS)
|
||||||
|
Verification started: 2017-03-01 16:25:17
|
||||||
|
Ended : 2017-03-01 16:25:18 (0 hours, 0 minutes and 31 seconds)
|
||||||
|
Acquisition speed : 3.94 MByte/s (0 hours, 0 minutes and 31 seconds)
|
||||||
|
Verification speed : 122.25 MByte/s (0 hours, 0 minutes and 1 seconds)
|
||||||
|
|
||||||
|
|
||||||
|
Generated image files and their MD5 hashes
|
||||||
|
==========================================
|
||||||
|
|
||||||
|
No MD5 hashes available (configuration parameter CalcImageFileMD5 is off)
|
||||||
|
MD5 Image file
|
||||||
|
n/a cf128mblin.000
|
||||||
BIN
images/cf128mbmac.dd
Executable file
BIN
images/cf128mbmac.dd
Executable file
Binary file not shown.
45
images/cf128mbmac.dd.txt
Executable file
45
images/cf128mbmac.dd.txt
Executable file
@ -0,0 +1,45 @@
|
|||||||
|
Created By AccessData® FTK® Imager 3.1.1.8
|
||||||
|
|
||||||
|
Case Information:
|
||||||
|
Acquired using: ADI3.1.1.8
|
||||||
|
Case Number: 20170301
|
||||||
|
Evidence Number: 9
|
||||||
|
Unique description: cf128mbmac
|
||||||
|
Examiner: Patrick Neumann
|
||||||
|
Notes: fatmapper test device (macOS)
|
||||||
|
|
||||||
|
--------------------------------------------------------------
|
||||||
|
|
||||||
|
Information for C:\Users\Patrick Neumann\Desktop\cf128mbmac:
|
||||||
|
|
||||||
|
Physical Evidentiary Item (Source) Information:
|
||||||
|
[Device Info]
|
||||||
|
Source Type: Physical
|
||||||
|
[Drive Geometry]
|
||||||
|
Cylinders: 15
|
||||||
|
Tracks per Cylinder: 255
|
||||||
|
Sectors per Track: 63
|
||||||
|
Bytes per Sector: 512
|
||||||
|
Sector Count: 250.368
|
||||||
|
[Physical Drive Information]
|
||||||
|
Drive Model: Generic- Compact Flash USB Device
|
||||||
|
Drive Serial Number: 20100818841300000
|
||||||
|
Drive Interface Type: USB
|
||||||
|
Removable drive: True
|
||||||
|
Source data size: 122 MB
|
||||||
|
Sector count: 250368
|
||||||
|
[Computed Hashes]
|
||||||
|
MD5 checksum: c337e6c43f53d5e82f81f04fec9782c1
|
||||||
|
SHA1 checksum: 1178d208d6a3beb0c14ea8e0120c314a7cf16d9e
|
||||||
|
|
||||||
|
Image Information:
|
||||||
|
Acquisition started: Wed Mar 01 14:54:50 2017
|
||||||
|
Acquisition finished: Wed Mar 01 14:55:26 2017
|
||||||
|
Segment list:
|
||||||
|
C:\Users\Patrick Neumann\Desktop\cf128mbmac.001
|
||||||
|
|
||||||
|
Image Verification Results:
|
||||||
|
Verification started: Wed Mar 01 14:55:26 2017
|
||||||
|
Verification finished: Wed Mar 01 14:55:27 2017
|
||||||
|
MD5 checksum: c337e6c43f53d5e82f81f04fec9782c1 : verified
|
||||||
|
SHA1 checksum: 1178d208d6a3beb0c14ea8e0120c314a7cf16d9e : verified
|
||||||
BIN
images/cf128mbwin.dd
Executable file
BIN
images/cf128mbwin.dd
Executable file
Binary file not shown.
45
images/cf128mbwin.dd.txt
Executable file
45
images/cf128mbwin.dd.txt
Executable file
@ -0,0 +1,45 @@
|
|||||||
|
Created By AccessData® FTK® Imager 3.1.1.8
|
||||||
|
|
||||||
|
Case Information:
|
||||||
|
Acquired using: ADI3.1.1.8
|
||||||
|
Case Number: 20170301
|
||||||
|
Evidence Number: 6
|
||||||
|
Unique description: cf128mb
|
||||||
|
Examiner: Patrick Neumann
|
||||||
|
Notes: fatmapper test device
|
||||||
|
|
||||||
|
--------------------------------------------------------------
|
||||||
|
|
||||||
|
Information for C:\Users\Patrick Neumann\Desktop\cf128mb:
|
||||||
|
|
||||||
|
Physical Evidentiary Item (Source) Information:
|
||||||
|
[Device Info]
|
||||||
|
Source Type: Physical
|
||||||
|
[Drive Geometry]
|
||||||
|
Cylinders: 15
|
||||||
|
Tracks per Cylinder: 255
|
||||||
|
Sectors per Track: 63
|
||||||
|
Bytes per Sector: 512
|
||||||
|
Sector Count: 250.368
|
||||||
|
[Physical Drive Information]
|
||||||
|
Drive Model: Generic- Compact Flash USB Device
|
||||||
|
Drive Serial Number: 20100818841300000
|
||||||
|
Drive Interface Type: USB
|
||||||
|
Removable drive: True
|
||||||
|
Source data size: 122 MB
|
||||||
|
Sector count: 250368
|
||||||
|
[Computed Hashes]
|
||||||
|
MD5 checksum: 6bdd6a12aedc6f2ac8d1b3aa957978c9
|
||||||
|
SHA1 checksum: cc9021f644b3ff6ff04b4cbe44c0d77e17f9bb9f
|
||||||
|
|
||||||
|
Image Information:
|
||||||
|
Acquisition started: Wed Mar 01 14:31:17 2017
|
||||||
|
Acquisition finished: Wed Mar 01 14:31:53 2017
|
||||||
|
Segment list:
|
||||||
|
C:\Users\Patrick Neumann\Desktop\cf128mb.001
|
||||||
|
|
||||||
|
Image Verification Results:
|
||||||
|
Verification started: Wed Mar 01 14:31:53 2017
|
||||||
|
Verification finished: Wed Mar 01 14:31:54 2017
|
||||||
|
MD5 checksum: 6bdd6a12aedc6f2ac8d1b3aa957978c9 : verified
|
||||||
|
SHA1 checksum: cc9021f644b3ff6ff04b4cbe44c0d77e17f9bb9f : verified
|
||||||
BIN
images/cf8mblin.dd
Executable file
BIN
images/cf8mblin.dd
Executable file
Binary file not shown.
112
images/cf8mblin.info
Executable file
112
images/cf8mblin.info
Executable file
@ -0,0 +1,112 @@
|
|||||||
|
|
||||||
|
GUYMAGER ACQUISITION INFO FILE
|
||||||
|
==============================
|
||||||
|
|
||||||
|
Guymager
|
||||||
|
========
|
||||||
|
|
||||||
|
Version : 0.8.3-1
|
||||||
|
Compilation timestamp: 2016-08-05-15.15.41
|
||||||
|
Compiled with : gcc 4.9.2
|
||||||
|
libewf version : 20140608
|
||||||
|
libguytools version : 2.1.0beta5
|
||||||
|
Host name : patrick01
|
||||||
|
Domain name : (none)
|
||||||
|
System : Linux patrick01 4.9.11-1-ARCH #1 SMP PREEMPT Sun Feb 19 13:45:52 UTC 2017 x86_64
|
||||||
|
|
||||||
|
|
||||||
|
Device information
|
||||||
|
==================
|
||||||
|
Command executed: bash -c "search="`basename /dev/sdc`: H..t P.......d A..a de.....d" && dmesg | grep -A3 "$search" || echo "No kernel HPA messages for /dev/sdc""
|
||||||
|
Information returned:
|
||||||
|
----------------------------------------------------------------------------------------------------
|
||||||
|
No kernel HPA messages for /dev/sdc
|
||||||
|
|
||||||
|
Command executed: bash -c "smartctl -s on /dev/sdc ; smartctl -a /dev/sdc"
|
||||||
|
Information returned:
|
||||||
|
----------------------------------------------------------------------------------------------------
|
||||||
|
smartctl 6.5 2016-05-07 r4318 [x86_64-linux-4.9.11-1-ARCH] (local build)
|
||||||
|
Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org
|
||||||
|
|
||||||
|
/dev/sdc: Unknown USB bridge [0x0bda:0x0184 (0x8413)]
|
||||||
|
Please specify device type with the -d option.
|
||||||
|
|
||||||
|
Use smartctl -h to get a usage summary
|
||||||
|
|
||||||
|
smartctl 6.5 2016-05-07 r4318 [x86_64-linux-4.9.11-1-ARCH] (local build)
|
||||||
|
Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org
|
||||||
|
|
||||||
|
/dev/sdc: Unknown USB bridge [0x0bda:0x0184 (0x8413)]
|
||||||
|
Please specify device type with the -d option.
|
||||||
|
|
||||||
|
Use smartctl -h to get a usage summary
|
||||||
|
|
||||||
|
Command executed: bash -c "hdparm -I /dev/sdc"
|
||||||
|
Information returned:
|
||||||
|
----------------------------------------------------------------------------------------------------
|
||||||
|
SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||||
|
|
||||||
|
/dev/sdc:
|
||||||
|
|
||||||
|
ATA device, with non-removable media
|
||||||
|
Standards:
|
||||||
|
Likely used: 1
|
||||||
|
Configuration:
|
||||||
|
Logical max current
|
||||||
|
cylinders 0 0
|
||||||
|
heads 0 0
|
||||||
|
sectors/track 0 0
|
||||||
|
--
|
||||||
|
Logical/Physical Sector size: 512 bytes
|
||||||
|
device size with M = 1024*1024: 0 MBytes
|
||||||
|
device size with M = 1000*1000: 0 MBytes
|
||||||
|
cache/buffer size = unknown
|
||||||
|
Capabilities:
|
||||||
|
IORDY not likely
|
||||||
|
Cannot perform double-word IO
|
||||||
|
R/W multiple sector transfer: not supported
|
||||||
|
DMA: not supported
|
||||||
|
PIO: pio0
|
||||||
|
|
||||||
|
Hidden areas: unknown
|
||||||
|
|
||||||
|
|
||||||
|
Acquisition
|
||||||
|
===========
|
||||||
|
|
||||||
|
Linux device : /dev/sdc
|
||||||
|
Device size : 8028160 (8,0MB)
|
||||||
|
Format : Linux split dd raw image - file extension is .xxx
|
||||||
|
Image path and file name: /home/neupat75/Entwicklung/fatmapper/cf8mblin.xxx
|
||||||
|
Info path and file name: /home/neupat75/Entwicklung/fatmapper/cf8mblin.info
|
||||||
|
Hash calculation : MD5 and SHA-1
|
||||||
|
Source verification : off
|
||||||
|
Image verification : on
|
||||||
|
|
||||||
|
No bad sectors encountered during acquisition.
|
||||||
|
State: Finished successfully
|
||||||
|
|
||||||
|
MD5 hash : 5099deba212fd5615b190d3e5a1212ae
|
||||||
|
MD5 hash verified source : --
|
||||||
|
MD5 hash verified image : 5099deba212fd5615b190d3e5a1212ae
|
||||||
|
SHA1 hash : 7e60fd1d939908969a8b685d41522def94c424e0
|
||||||
|
SHA1 hash verified source : --
|
||||||
|
SHA1 hash verified image : 7e60fd1d939908969a8b685d41522def94c424e0
|
||||||
|
SHA256 hash : --
|
||||||
|
SHA256 hash verified source: --
|
||||||
|
SHA256 hash verified image : --
|
||||||
|
Image verification OK. The image contains exactly the data that was written.
|
||||||
|
|
||||||
|
Acquisition started : 2017-03-01 16:13:51 (ISO format YYYY-MM-DD HH:MM:SS)
|
||||||
|
Verification started: 2017-03-01 16:13:54
|
||||||
|
Ended : 2017-03-01 16:13:54 (0 hours, 0 minutes and 2 seconds)
|
||||||
|
Acquisition speed : 3.83 MByte/s (0 hours, 0 minutes and 2 seconds)
|
||||||
|
Verification speed : 7.66 MByte/s (0 hours, 0 minutes and 1 seconds)
|
||||||
|
|
||||||
|
|
||||||
|
Generated image files and their MD5 hashes
|
||||||
|
==========================================
|
||||||
|
|
||||||
|
No MD5 hashes available (configuration parameter CalcImageFileMD5 is off)
|
||||||
|
MD5 Image file
|
||||||
|
n/a cf8mblin.000
|
||||||
BIN
images/cf8mbmac.dd
Executable file
BIN
images/cf8mbmac.dd
Executable file
Binary file not shown.
45
images/cf8mbmac.dd.txt
Executable file
45
images/cf8mbmac.dd.txt
Executable file
@ -0,0 +1,45 @@
|
|||||||
|
Created By AccessData® FTK® Imager 3.1.1.8
|
||||||
|
|
||||||
|
Case Information:
|
||||||
|
Acquired using: ADI3.1.1.8
|
||||||
|
Case Number: 20170301
|
||||||
|
Evidence Number: 7
|
||||||
|
Unique description: cf8mbmac
|
||||||
|
Examiner: Patrick Neumann
|
||||||
|
Notes: fatmapper test device (macOS)
|
||||||
|
|
||||||
|
--------------------------------------------------------------
|
||||||
|
|
||||||
|
Information for C:\Users\Patrick Neumann\Desktop\cf8mbmac:
|
||||||
|
|
||||||
|
Physical Evidentiary Item (Source) Information:
|
||||||
|
[Device Info]
|
||||||
|
Source Type: Physical
|
||||||
|
[Drive Geometry]
|
||||||
|
Cylinders: 15.744
|
||||||
|
Tracks per Cylinder: 1
|
||||||
|
Sectors per Track: 1
|
||||||
|
Bytes per Sector: 512
|
||||||
|
Sector Count: 15.744
|
||||||
|
[Physical Drive Information]
|
||||||
|
Drive Model: Generic- Compact Flash USB Device
|
||||||
|
Drive Serial Number: 20100818841300000
|
||||||
|
Drive Interface Type: USB
|
||||||
|
Removable drive: True
|
||||||
|
Source data size: 7 MB
|
||||||
|
Sector count: 15744
|
||||||
|
[Computed Hashes]
|
||||||
|
MD5 checksum: 66bed0a2807ecc7164cf16696b79873f
|
||||||
|
SHA1 checksum: 358ece8f26ae0f9d12e36f3a854a6c817fb67774
|
||||||
|
|
||||||
|
Image Information:
|
||||||
|
Acquisition started: Wed Mar 01 15:38:15 2017
|
||||||
|
Acquisition finished: Wed Mar 01 15:38:18 2017
|
||||||
|
Segment list:
|
||||||
|
C:\Users\Patrick Neumann\Desktop\cf8mbmac.001
|
||||||
|
|
||||||
|
Image Verification Results:
|
||||||
|
Verification started: Wed Mar 01 15:38:18 2017
|
||||||
|
Verification finished: Wed Mar 01 15:38:19 2017
|
||||||
|
MD5 checksum: 66bed0a2807ecc7164cf16696b79873f : verified
|
||||||
|
SHA1 checksum: 358ece8f26ae0f9d12e36f3a854a6c817fb67774 : verified
|
||||||
BIN
images/cf8mbwin.dd
Executable file
BIN
images/cf8mbwin.dd
Executable file
Binary file not shown.
45
images/cf8mbwin.dd.txt
Executable file
45
images/cf8mbwin.dd.txt
Executable file
@ -0,0 +1,45 @@
|
|||||||
|
Created By AccessData® FTK® Imager 3.1.1.8
|
||||||
|
|
||||||
|
Case Information:
|
||||||
|
Acquired using: ADI3.1.1.8
|
||||||
|
Case Number: 20170301
|
||||||
|
Evidence Number: 4
|
||||||
|
Unique description: cf8mb
|
||||||
|
Examiner: Patrick Neumann
|
||||||
|
Notes: fatmapper test device
|
||||||
|
|
||||||
|
--------------------------------------------------------------
|
||||||
|
|
||||||
|
Information for C:\Users\Patrick Neumann\Desktop\cf8mb:
|
||||||
|
|
||||||
|
Physical Evidentiary Item (Source) Information:
|
||||||
|
[Device Info]
|
||||||
|
Source Type: Physical
|
||||||
|
[Drive Geometry]
|
||||||
|
Cylinders: 15.680
|
||||||
|
Tracks per Cylinder: 1
|
||||||
|
Sectors per Track: 1
|
||||||
|
Bytes per Sector: 512
|
||||||
|
Sector Count: 15.680
|
||||||
|
[Physical Drive Information]
|
||||||
|
Drive Model: Generic- Compact Flash USB Device
|
||||||
|
Drive Serial Number: 20100818841300000
|
||||||
|
Drive Interface Type: USB
|
||||||
|
Removable drive: True
|
||||||
|
Source data size: 7 MB
|
||||||
|
Sector count: 15680
|
||||||
|
[Computed Hashes]
|
||||||
|
MD5 checksum: abd366789ba7985fef66d5ccc1febdb3
|
||||||
|
SHA1 checksum: 11e3f780ffff697b713e479c2965963d0d960147
|
||||||
|
|
||||||
|
Image Information:
|
||||||
|
Acquisition started: Wed Mar 01 15:40:54 2017
|
||||||
|
Acquisition finished: Wed Mar 01 15:40:57 2017
|
||||||
|
Segment list:
|
||||||
|
C:\Users\Patrick Neumann\Desktop\cf8mb.001
|
||||||
|
|
||||||
|
Image Verification Results:
|
||||||
|
Verification started: Wed Mar 01 15:40:57 2017
|
||||||
|
Verification finished: Wed Mar 01 15:40:57 2017
|
||||||
|
MD5 checksum: abd366789ba7985fef66d5ccc1febdb3 : verified
|
||||||
|
SHA1 checksum: 11e3f780ffff697b713e479c2965963d0d960147 : verified
|
||||||
BIN
images/sm32mblin.dd
Executable file
BIN
images/sm32mblin.dd
Executable file
Binary file not shown.
112
images/sm32mblin.info
Executable file
112
images/sm32mblin.info
Executable file
@ -0,0 +1,112 @@
|
|||||||
|
|
||||||
|
GUYMAGER ACQUISITION INFO FILE
|
||||||
|
==============================
|
||||||
|
|
||||||
|
Guymager
|
||||||
|
========
|
||||||
|
|
||||||
|
Version : 0.8.3-1
|
||||||
|
Compilation timestamp: 2016-08-05-15.15.41
|
||||||
|
Compiled with : gcc 4.9.2
|
||||||
|
libewf version : 20140608
|
||||||
|
libguytools version : 2.1.0beta5
|
||||||
|
Host name : patrick01
|
||||||
|
Domain name : (none)
|
||||||
|
System : Linux patrick01 4.9.11-1-ARCH #1 SMP PREEMPT Sun Feb 19 13:45:52 UTC 2017 x86_64
|
||||||
|
|
||||||
|
|
||||||
|
Device information
|
||||||
|
==================
|
||||||
|
Command executed: bash -c "search="`basename /dev/sdd`: H..t P.......d A..a de.....d" && dmesg | grep -A3 "$search" || echo "No kernel HPA messages for /dev/sdd""
|
||||||
|
Information returned:
|
||||||
|
----------------------------------------------------------------------------------------------------
|
||||||
|
No kernel HPA messages for /dev/sdd
|
||||||
|
|
||||||
|
Command executed: bash -c "smartctl -s on /dev/sdd ; smartctl -a /dev/sdd"
|
||||||
|
Information returned:
|
||||||
|
----------------------------------------------------------------------------------------------------
|
||||||
|
smartctl 6.5 2016-05-07 r4318 [x86_64-linux-4.9.11-1-ARCH] (local build)
|
||||||
|
Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org
|
||||||
|
|
||||||
|
/dev/sdd: Unknown USB bridge [0x0bda:0x0184 (0x8413)]
|
||||||
|
Please specify device type with the -d option.
|
||||||
|
|
||||||
|
Use smartctl -h to get a usage summary
|
||||||
|
|
||||||
|
smartctl 6.5 2016-05-07 r4318 [x86_64-linux-4.9.11-1-ARCH] (local build)
|
||||||
|
Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org
|
||||||
|
|
||||||
|
/dev/sdd: Unknown USB bridge [0x0bda:0x0184 (0x8413)]
|
||||||
|
Please specify device type with the -d option.
|
||||||
|
|
||||||
|
Use smartctl -h to get a usage summary
|
||||||
|
|
||||||
|
Command executed: bash -c "hdparm -I /dev/sdd"
|
||||||
|
Information returned:
|
||||||
|
----------------------------------------------------------------------------------------------------
|
||||||
|
SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
||||||
|
|
||||||
|
/dev/sdd:
|
||||||
|
|
||||||
|
ATA device, with non-removable media
|
||||||
|
Standards:
|
||||||
|
Likely used: 1
|
||||||
|
Configuration:
|
||||||
|
Logical max current
|
||||||
|
cylinders 0 0
|
||||||
|
heads 0 0
|
||||||
|
sectors/track 0 0
|
||||||
|
--
|
||||||
|
Logical/Physical Sector size: 512 bytes
|
||||||
|
device size with M = 1024*1024: 0 MBytes
|
||||||
|
device size with M = 1000*1000: 0 MBytes
|
||||||
|
cache/buffer size = unknown
|
||||||
|
Capabilities:
|
||||||
|
IORDY not likely
|
||||||
|
Cannot perform double-word IO
|
||||||
|
R/W multiple sector transfer: not supported
|
||||||
|
DMA: not supported
|
||||||
|
PIO: pio0
|
||||||
|
|
||||||
|
Hidden areas: unknown
|
||||||
|
|
||||||
|
|
||||||
|
Acquisition
|
||||||
|
===========
|
||||||
|
|
||||||
|
Linux device : /dev/sdd
|
||||||
|
Device size : 32768000 (32,8MB)
|
||||||
|
Format : Linux split dd raw image - file extension is .xxx
|
||||||
|
Image path and file name: /home/neupat75/Entwicklung/fatmapper/sm32mblin.xxx
|
||||||
|
Info path and file name: /home/neupat75/Entwicklung/fatmapper/sm32mblin.info
|
||||||
|
Hash calculation : MD5 and SHA-1
|
||||||
|
Source verification : off
|
||||||
|
Image verification : on
|
||||||
|
|
||||||
|
No bad sectors encountered during acquisition.
|
||||||
|
State: Finished successfully
|
||||||
|
|
||||||
|
MD5 hash : 7dc7264f3c0e2c99d962e934d8500289
|
||||||
|
MD5 hash verified source : --
|
||||||
|
MD5 hash verified image : 7dc7264f3c0e2c99d962e934d8500289
|
||||||
|
SHA1 hash : 4de63aada61e6db166ef2e1ab60830d6043500a8
|
||||||
|
SHA1 hash verified source : --
|
||||||
|
SHA1 hash verified image : 4de63aada61e6db166ef2e1ab60830d6043500a8
|
||||||
|
SHA256 hash : --
|
||||||
|
SHA256 hash verified source: --
|
||||||
|
SHA256 hash verified image : --
|
||||||
|
Image verification OK. The image contains exactly the data that was written.
|
||||||
|
|
||||||
|
Acquisition started : 2017-03-01 16:19:14 (ISO format YYYY-MM-DD HH:MM:SS)
|
||||||
|
Verification started: 2017-03-01 16:19:18
|
||||||
|
Ended : 2017-03-01 16:19:18 (0 hours, 0 minutes and 4 seconds)
|
||||||
|
Acquisition speed : 7.81 MByte/s (0 hours, 0 minutes and 4 seconds)
|
||||||
|
Verification speed : 31.25 MByte/s (0 hours, 0 minutes and 1 seconds)
|
||||||
|
|
||||||
|
|
||||||
|
Generated image files and their MD5 hashes
|
||||||
|
==========================================
|
||||||
|
|
||||||
|
No MD5 hashes available (configuration parameter CalcImageFileMD5 is off)
|
||||||
|
MD5 Image file
|
||||||
|
n/a sm32mblin.000
|
||||||
BIN
images/sm32mbmac.dd
Executable file
BIN
images/sm32mbmac.dd
Executable file
Binary file not shown.
45
images/sm32mbmac.dd.txt
Executable file
45
images/sm32mbmac.dd.txt
Executable file
@ -0,0 +1,45 @@
|
|||||||
|
Created By AccessData® FTK® Imager 3.1.1.8
|
||||||
|
|
||||||
|
Case Information:
|
||||||
|
Acquired using: ADI3.1.1.8
|
||||||
|
Case Number: 20170301
|
||||||
|
Evidence Number: 8
|
||||||
|
Unique description: sm32mbmac
|
||||||
|
Examiner: Patrick Neumann
|
||||||
|
Notes: fatmapper test device (macOS)
|
||||||
|
|
||||||
|
--------------------------------------------------------------
|
||||||
|
|
||||||
|
Information for C:\Users\Patrick Neumann\Desktop\sm32mbmac:
|
||||||
|
|
||||||
|
Physical Evidentiary Item (Source) Information:
|
||||||
|
[Device Info]
|
||||||
|
Source Type: Physical
|
||||||
|
[Drive Geometry]
|
||||||
|
Cylinders: 3
|
||||||
|
Tracks per Cylinder: 255
|
||||||
|
Sectors per Track: 63
|
||||||
|
Bytes per Sector: 512
|
||||||
|
Sector Count: 64.000
|
||||||
|
[Physical Drive Information]
|
||||||
|
Drive Model: Generic USB SM Reader USB Device
|
||||||
|
Drive Serial Number: 058F312D812
|
||||||
|
Drive Interface Type: USB
|
||||||
|
Removable drive: True
|
||||||
|
Source data size: 31 MB
|
||||||
|
Sector count: 64000
|
||||||
|
[Computed Hashes]
|
||||||
|
MD5 checksum: 86b7cafaab98751338f6efb817802324
|
||||||
|
SHA1 checksum: 5d6ba021d9f6a2ca3aca817ec7cf20e7ee05bf16
|
||||||
|
|
||||||
|
Image Information:
|
||||||
|
Acquisition started: Wed Mar 01 14:50:43 2017
|
||||||
|
Acquisition finished: Wed Mar 01 14:50:52 2017
|
||||||
|
Segment list:
|
||||||
|
C:\Users\Patrick Neumann\Desktop\sm32mbmac.001
|
||||||
|
|
||||||
|
Image Verification Results:
|
||||||
|
Verification started: Wed Mar 01 14:50:52 2017
|
||||||
|
Verification finished: Wed Mar 01 14:50:52 2017
|
||||||
|
MD5 checksum: 86b7cafaab98751338f6efb817802324 : verified
|
||||||
|
SHA1 checksum: 5d6ba021d9f6a2ca3aca817ec7cf20e7ee05bf16 : verified
|
||||||
BIN
images/sm32mbwin.dd
Executable file
BIN
images/sm32mbwin.dd
Executable file
Binary file not shown.
45
images/sm32mbwin.dd.txt
Executable file
45
images/sm32mbwin.dd.txt
Executable file
@ -0,0 +1,45 @@
|
|||||||
|
Created By AccessData® FTK® Imager 3.1.1.8
|
||||||
|
|
||||||
|
Case Information:
|
||||||
|
Acquired using: ADI3.1.1.8
|
||||||
|
Case Number: 20170301
|
||||||
|
Evidence Number: 5
|
||||||
|
Unique description: sm32mb
|
||||||
|
Examiner: Patrick Neumann
|
||||||
|
Notes: fatmapper test device
|
||||||
|
|
||||||
|
--------------------------------------------------------------
|
||||||
|
|
||||||
|
Information for C:\Users\Patrick Neumann\Desktop\sm32mb:
|
||||||
|
|
||||||
|
Physical Evidentiary Item (Source) Information:
|
||||||
|
[Device Info]
|
||||||
|
Source Type: Physical
|
||||||
|
[Drive Geometry]
|
||||||
|
Cylinders: 3
|
||||||
|
Tracks per Cylinder: 255
|
||||||
|
Sectors per Track: 63
|
||||||
|
Bytes per Sector: 512
|
||||||
|
Sector Count: 64.000
|
||||||
|
[Physical Drive Information]
|
||||||
|
Drive Model: Generic USB SM Reader USB Device
|
||||||
|
Drive Serial Number: 058F312D812
|
||||||
|
Drive Interface Type: USB
|
||||||
|
Removable drive: True
|
||||||
|
Source data size: 31 MB
|
||||||
|
Sector count: 64000
|
||||||
|
[Computed Hashes]
|
||||||
|
MD5 checksum: a350f05a57e1cd945bda0ed106080f1b
|
||||||
|
SHA1 checksum: 96a3610c7af62103ee91285db25eb239beff34a4
|
||||||
|
|
||||||
|
Image Information:
|
||||||
|
Acquisition started: Wed Mar 01 14:36:15 2017
|
||||||
|
Acquisition finished: Wed Mar 01 14:36:24 2017
|
||||||
|
Segment list:
|
||||||
|
C:\Users\Patrick Neumann\Desktop\sm32mb.001
|
||||||
|
|
||||||
|
Image Verification Results:
|
||||||
|
Verification started: Wed Mar 01 14:36:24 2017
|
||||||
|
Verification finished: Wed Mar 01 14:36:24 2017
|
||||||
|
MD5 checksum: a350f05a57e1cd945bda0ed106080f1b : verified
|
||||||
|
SHA1 checksum: 96a3610c7af62103ee91285db25eb239beff34a4 : verified
|
||||||
Loading…
x
Reference in New Issue
Block a user