casualscripter/fatmapper
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added a lot of images

Browse Source
This commit is contained in:
Patrick Neumann 2018-06-16 14:13:50 +02:00
parent 8eb9a58938
commit 649e51f3b6
18 changed files with 606 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
images/cf128mblin.dd Executable file
View File

Binary file not shown.

112
images/cf128mblin.info Executable file
View File

@ -0,0 +1,112 @@
GUYMAGER ACQUISITION INFO FILE
==============================
Guymager
========
Version : 0.8.3-1
Compilation timestamp: 2016-08-05-15.15.41
Compiled with : gcc 4.9.2
libewf version : 20140608
libguytools version : 2.1.0beta5
Host name : patrick01
Domain name : (none)
System : Linux patrick01 4.9.11-1-ARCH #1 SMP PREEMPT Sun Feb 19 13:45:52 UTC 2017 x86_64
Device information
==================
Command executed: bash -c "search="`basename /dev/sdc`: H..t P.......d A..a de.....d" && dmesg | grep -A3 "$search" || echo "No kernel HPA messages for /dev/sdc""
Information returned:
----------------------------------------------------------------------------------------------------
No kernel HPA messages for /dev/sdc
Command executed: bash -c "smartctl -s on /dev/sdc ; smartctl -a /dev/sdc"
Information returned:
----------------------------------------------------------------------------------------------------
smartctl 6.5 2016-05-07 r4318 [x86_64-linux-4.9.11-1-ARCH] (local build)
Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org
/dev/sdc: Unknown USB bridge [0x0bda:0x0184 (0x8413)]
Please specify device type with the -d option.
Use smartctl -h to get a usage summary
smartctl 6.5 2016-05-07 r4318 [x86_64-linux-4.9.11-1-ARCH] (local build)
Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org
/dev/sdc: Unknown USB bridge [0x0bda:0x0184 (0x8413)]
Please specify device type with the -d option.
Use smartctl -h to get a usage summary
Command executed: bash -c "hdparm -I /dev/sdc"
Information returned:
----------------------------------------------------------------------------------------------------
SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
/dev/sdc:
ATA device, with non-removable media
Standards:
Likely used: 1
Configuration:
Logical max current
cylinders 0 0
heads 0 0
sectors/track 0 0
--
Logical/Physical Sector size: 512 bytes
device size with M = 1024*1024: 0 MBytes
device size with M = 1000*1000: 0 MBytes
cache/buffer size = unknown
Capabilities:
IORDY not likely
Cannot perform double-word IO
R/W multiple sector transfer: not supported
DMA: not supported
PIO: pio0
Hidden areas: unknown
Acquisition
===========
Linux device : /dev/sdc
Device size : 128188416 (128,2MB)
Format : Linux split dd raw image - file extension is .xxx
Image path and file name: /home/neupat75/Entwicklung/fatmapper/cf128mblin.xxx
Info path and file name: /home/neupat75/Entwicklung/fatmapper/cf128mblin.info
Hash calculation : MD5 and SHA-1
Source verification : off
Image verification : on
No bad sectors encountered during acquisition.
State: Finished successfully
MD5 hash : 1b927cec90d244aa8b0aa76b1edeb3ea
MD5 hash verified source : --
MD5 hash verified image : 1b927cec90d244aa8b0aa76b1edeb3ea
SHA1 hash : 7bb98b42c7edcbe6ba4981c6287a3ab6d4b3cd8b
SHA1 hash verified source : --
SHA1 hash verified image : 7bb98b42c7edcbe6ba4981c6287a3ab6d4b3cd8b
SHA256 hash : --
SHA256 hash verified source: --
SHA256 hash verified image : --
Image verification OK. The image contains exactly the data that was written.
Acquisition started : 2017-03-01 16:24:46 (ISO format YYYY-MM-DD HH:MM:SS)
Verification started: 2017-03-01 16:25:17
Ended : 2017-03-01 16:25:18 (0 hours, 0 minutes and 31 seconds)
Acquisition speed : 3.94 MByte/s (0 hours, 0 minutes and 31 seconds)
Verification speed : 122.25 MByte/s (0 hours, 0 minutes and 1 seconds)
Generated image files and their MD5 hashes
==========================================
No MD5 hashes available (configuration parameter CalcImageFileMD5 is off)
MD5 Image file
n/a cf128mblin.000

BIN
images/cf128mbmac.dd Executable file
View File

Binary file not shown.

45
images/cf128mbmac.dd.txt Executable file
View File

@ -0,0 +1,45 @@
Created By AccessData® FTK® Imager 3.1.1.8
Case Information:
Acquired using: ADI3.1.1.8
Case Number: 20170301
Evidence Number: 9
Unique description: cf128mbmac
Examiner: Patrick Neumann
Notes: fatmapper test device (macOS)
--------------------------------------------------------------
Information for C:\Users\Patrick Neumann\Desktop\cf128mbmac:
Physical Evidentiary Item (Source) Information:
[Device Info]
Source Type: Physical
[Drive Geometry]
Cylinders: 15
Tracks per Cylinder: 255
Sectors per Track: 63
Bytes per Sector: 512
Sector Count: 250.368
[Physical Drive Information]
Drive Model: Generic- Compact Flash USB Device
Drive Serial Number: 20100818841300000
Drive Interface Type: USB
Removable drive: True
Source data size: 122 MB
Sector count: 250368
[Computed Hashes]
MD5 checksum: c337e6c43f53d5e82f81f04fec9782c1
SHA1 checksum: 1178d208d6a3beb0c14ea8e0120c314a7cf16d9e
Image Information:
Acquisition started: Wed Mar 01 14:54:50 2017
Acquisition finished: Wed Mar 01 14:55:26 2017
Segment list:
C:\Users\Patrick Neumann\Desktop\cf128mbmac.001
Image Verification Results:
Verification started: Wed Mar 01 14:55:26 2017
Verification finished: Wed Mar 01 14:55:27 2017
MD5 checksum: c337e6c43f53d5e82f81f04fec9782c1 : verified
SHA1 checksum: 1178d208d6a3beb0c14ea8e0120c314a7cf16d9e : verified

BIN
images/cf128mbwin.dd Executable file
View File

Binary file not shown.

45
images/cf128mbwin.dd.txt Executable file
View File

@ -0,0 +1,45 @@
Created By AccessData® FTK® Imager 3.1.1.8
Case Information:
Acquired using: ADI3.1.1.8
Case Number: 20170301
Evidence Number: 6
Unique description: cf128mb
Examiner: Patrick Neumann
Notes: fatmapper test device
--------------------------------------------------------------
Information for C:\Users\Patrick Neumann\Desktop\cf128mb:
Physical Evidentiary Item (Source) Information:
[Device Info]
Source Type: Physical
[Drive Geometry]
Cylinders: 15
Tracks per Cylinder: 255
Sectors per Track: 63
Bytes per Sector: 512
Sector Count: 250.368
[Physical Drive Information]
Drive Model: Generic- Compact Flash USB Device
Drive Serial Number: 20100818841300000
Drive Interface Type: USB
Removable drive: True
Source data size: 122 MB
Sector count: 250368
[Computed Hashes]
MD5 checksum: 6bdd6a12aedc6f2ac8d1b3aa957978c9
SHA1 checksum: cc9021f644b3ff6ff04b4cbe44c0d77e17f9bb9f
Image Information:
Acquisition started: Wed Mar 01 14:31:17 2017
Acquisition finished: Wed Mar 01 14:31:53 2017
Segment list:
C:\Users\Patrick Neumann\Desktop\cf128mb.001
Image Verification Results:
Verification started: Wed Mar 01 14:31:53 2017
Verification finished: Wed Mar 01 14:31:54 2017
MD5 checksum: 6bdd6a12aedc6f2ac8d1b3aa957978c9 : verified
SHA1 checksum: cc9021f644b3ff6ff04b4cbe44c0d77e17f9bb9f : verified

BIN
images/cf8mblin.dd Executable file
View File

Binary file not shown.

112
images/cf8mblin.info Executable file
View File

@ -0,0 +1,112 @@
GUYMAGER ACQUISITION INFO FILE
==============================
Guymager
========
Version : 0.8.3-1
Compilation timestamp: 2016-08-05-15.15.41
Compiled with : gcc 4.9.2
libewf version : 20140608
libguytools version : 2.1.0beta5
Host name : patrick01
Domain name : (none)
System : Linux patrick01 4.9.11-1-ARCH #1 SMP PREEMPT Sun Feb 19 13:45:52 UTC 2017 x86_64
Device information
==================
Command executed: bash -c "search="`basename /dev/sdc`: H..t P.......d A..a de.....d" && dmesg | grep -A3 "$search" || echo "No kernel HPA messages for /dev/sdc""
Information returned:
----------------------------------------------------------------------------------------------------
No kernel HPA messages for /dev/sdc
Command executed: bash -c "smartctl -s on /dev/sdc ; smartctl -a /dev/sdc"
Information returned:
----------------------------------------------------------------------------------------------------
smartctl 6.5 2016-05-07 r4318 [x86_64-linux-4.9.11-1-ARCH] (local build)
Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org
/dev/sdc: Unknown USB bridge [0x0bda:0x0184 (0x8413)]
Please specify device type with the -d option.
Use smartctl -h to get a usage summary
smartctl 6.5 2016-05-07 r4318 [x86_64-linux-4.9.11-1-ARCH] (local build)
Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org
/dev/sdc: Unknown USB bridge [0x0bda:0x0184 (0x8413)]
Please specify device type with the -d option.
Use smartctl -h to get a usage summary
Command executed: bash -c "hdparm -I /dev/sdc"
Information returned:
----------------------------------------------------------------------------------------------------
SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
/dev/sdc:
ATA device, with non-removable media
Standards:
Likely used: 1
Configuration:
Logical max current
cylinders 0 0
heads 0 0
sectors/track 0 0
--
Logical/Physical Sector size: 512 bytes
device size with M = 1024*1024: 0 MBytes
device size with M = 1000*1000: 0 MBytes
cache/buffer size = unknown
Capabilities:
IORDY not likely
Cannot perform double-word IO
R/W multiple sector transfer: not supported
DMA: not supported
PIO: pio0
Hidden areas: unknown
Acquisition
===========
Linux device : /dev/sdc
Device size : 8028160 (8,0MB)
Format : Linux split dd raw image - file extension is .xxx
Image path and file name: /home/neupat75/Entwicklung/fatmapper/cf8mblin.xxx
Info path and file name: /home/neupat75/Entwicklung/fatmapper/cf8mblin.info
Hash calculation : MD5 and SHA-1
Source verification : off
Image verification : on
No bad sectors encountered during acquisition.
State: Finished successfully
MD5 hash : 5099deba212fd5615b190d3e5a1212ae
MD5 hash verified source : --
MD5 hash verified image : 5099deba212fd5615b190d3e5a1212ae
SHA1 hash : 7e60fd1d939908969a8b685d41522def94c424e0
SHA1 hash verified source : --
SHA1 hash verified image : 7e60fd1d939908969a8b685d41522def94c424e0
SHA256 hash : --
SHA256 hash verified source: --
SHA256 hash verified image : --
Image verification OK. The image contains exactly the data that was written.
Acquisition started : 2017-03-01 16:13:51 (ISO format YYYY-MM-DD HH:MM:SS)
Verification started: 2017-03-01 16:13:54
Ended : 2017-03-01 16:13:54 (0 hours, 0 minutes and 2 seconds)
Acquisition speed : 3.83 MByte/s (0 hours, 0 minutes and 2 seconds)
Verification speed : 7.66 MByte/s (0 hours, 0 minutes and 1 seconds)
Generated image files and their MD5 hashes
==========================================
No MD5 hashes available (configuration parameter CalcImageFileMD5 is off)
MD5 Image file
n/a cf8mblin.000

BIN
images/cf8mbmac.dd Executable file
View File

Binary file not shown.

45
images/cf8mbmac.dd.txt Executable file
View File

@ -0,0 +1,45 @@
Created By AccessData® FTK® Imager 3.1.1.8
Case Information:
Acquired using: ADI3.1.1.8
Case Number: 20170301
Evidence Number: 7
Unique description: cf8mbmac
Examiner: Patrick Neumann
Notes: fatmapper test device (macOS)
--------------------------------------------------------------
Information for C:\Users\Patrick Neumann\Desktop\cf8mbmac:
Physical Evidentiary Item (Source) Information:
[Device Info]
Source Type: Physical
[Drive Geometry]
Cylinders: 15.744
Tracks per Cylinder: 1
Sectors per Track: 1
Bytes per Sector: 512
Sector Count: 15.744
[Physical Drive Information]
Drive Model: Generic- Compact Flash USB Device
Drive Serial Number: 20100818841300000
Drive Interface Type: USB
Removable drive: True
Source data size: 7 MB
Sector count: 15744
[Computed Hashes]
MD5 checksum: 66bed0a2807ecc7164cf16696b79873f
SHA1 checksum: 358ece8f26ae0f9d12e36f3a854a6c817fb67774
Image Information:
Acquisition started: Wed Mar 01 15:38:15 2017
Acquisition finished: Wed Mar 01 15:38:18 2017
Segment list:
C:\Users\Patrick Neumann\Desktop\cf8mbmac.001
Image Verification Results:
Verification started: Wed Mar 01 15:38:18 2017
Verification finished: Wed Mar 01 15:38:19 2017
MD5 checksum: 66bed0a2807ecc7164cf16696b79873f : verified
SHA1 checksum: 358ece8f26ae0f9d12e36f3a854a6c817fb67774 : verified

BIN
images/cf8mbwin.dd Executable file
View File

Binary file not shown.

45
images/cf8mbwin.dd.txt Executable file
View File

@ -0,0 +1,45 @@
Created By AccessData® FTK® Imager 3.1.1.8
Case Information:
Acquired using: ADI3.1.1.8
Case Number: 20170301
Evidence Number: 4
Unique description: cf8mb
Examiner: Patrick Neumann
Notes: fatmapper test device
--------------------------------------------------------------
Information for C:\Users\Patrick Neumann\Desktop\cf8mb:
Physical Evidentiary Item (Source) Information:
[Device Info]
Source Type: Physical
[Drive Geometry]
Cylinders: 15.680
Tracks per Cylinder: 1
Sectors per Track: 1
Bytes per Sector: 512
Sector Count: 15.680
[Physical Drive Information]
Drive Model: Generic- Compact Flash USB Device
Drive Serial Number: 20100818841300000
Drive Interface Type: USB
Removable drive: True
Source data size: 7 MB
Sector count: 15680
[Computed Hashes]
MD5 checksum: abd366789ba7985fef66d5ccc1febdb3
SHA1 checksum: 11e3f780ffff697b713e479c2965963d0d960147
Image Information:
Acquisition started: Wed Mar 01 15:40:54 2017
Acquisition finished: Wed Mar 01 15:40:57 2017
Segment list:
C:\Users\Patrick Neumann\Desktop\cf8mb.001
Image Verification Results:
Verification started: Wed Mar 01 15:40:57 2017
Verification finished: Wed Mar 01 15:40:57 2017
MD5 checksum: abd366789ba7985fef66d5ccc1febdb3 : verified
SHA1 checksum: 11e3f780ffff697b713e479c2965963d0d960147 : verified

BIN
images/sm32mblin.dd Executable file
View File

Binary file not shown.

112
images/sm32mblin.info Executable file
View File

@ -0,0 +1,112 @@
GUYMAGER ACQUISITION INFO FILE
==============================
Guymager
========
Version : 0.8.3-1
Compilation timestamp: 2016-08-05-15.15.41
Compiled with : gcc 4.9.2
libewf version : 20140608
libguytools version : 2.1.0beta5
Host name : patrick01
Domain name : (none)
System : Linux patrick01 4.9.11-1-ARCH #1 SMP PREEMPT Sun Feb 19 13:45:52 UTC 2017 x86_64
Device information
==================
Command executed: bash -c "search="`basename /dev/sdd`: H..t P.......d A..a de.....d" && dmesg | grep -A3 "$search" || echo "No kernel HPA messages for /dev/sdd""
Information returned:
----------------------------------------------------------------------------------------------------
No kernel HPA messages for /dev/sdd
Command executed: bash -c "smartctl -s on /dev/sdd ; smartctl -a /dev/sdd"
Information returned:
----------------------------------------------------------------------------------------------------
smartctl 6.5 2016-05-07 r4318 [x86_64-linux-4.9.11-1-ARCH] (local build)
Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org
/dev/sdd: Unknown USB bridge [0x0bda:0x0184 (0x8413)]
Please specify device type with the -d option.
Use smartctl -h to get a usage summary
smartctl 6.5 2016-05-07 r4318 [x86_64-linux-4.9.11-1-ARCH] (local build)
Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org
/dev/sdd: Unknown USB bridge [0x0bda:0x0184 (0x8413)]
Please specify device type with the -d option.
Use smartctl -h to get a usage summary
Command executed: bash -c "hdparm -I /dev/sdd"
Information returned:
----------------------------------------------------------------------------------------------------
SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
/dev/sdd:
ATA device, with non-removable media
Standards:
Likely used: 1
Configuration:
Logical max current
cylinders 0 0
heads 0 0
sectors/track 0 0
--
Logical/Physical Sector size: 512 bytes
device size with M = 1024*1024: 0 MBytes
device size with M = 1000*1000: 0 MBytes
cache/buffer size = unknown
Capabilities:
IORDY not likely
Cannot perform double-word IO
R/W multiple sector transfer: not supported
DMA: not supported
PIO: pio0
Hidden areas: unknown
Acquisition
===========
Linux device : /dev/sdd
Device size : 32768000 (32,8MB)
Format : Linux split dd raw image - file extension is .xxx
Image path and file name: /home/neupat75/Entwicklung/fatmapper/sm32mblin.xxx
Info path and file name: /home/neupat75/Entwicklung/fatmapper/sm32mblin.info
Hash calculation : MD5 and SHA-1
Source verification : off
Image verification : on
No bad sectors encountered during acquisition.
State: Finished successfully
MD5 hash : 7dc7264f3c0e2c99d962e934d8500289
MD5 hash verified source : --
MD5 hash verified image : 7dc7264f3c0e2c99d962e934d8500289
SHA1 hash : 4de63aada61e6db166ef2e1ab60830d6043500a8
SHA1 hash verified source : --
SHA1 hash verified image : 4de63aada61e6db166ef2e1ab60830d6043500a8
SHA256 hash : --
SHA256 hash verified source: --
SHA256 hash verified image : --
Image verification OK. The image contains exactly the data that was written.
Acquisition started : 2017-03-01 16:19:14 (ISO format YYYY-MM-DD HH:MM:SS)
Verification started: 2017-03-01 16:19:18
Ended : 2017-03-01 16:19:18 (0 hours, 0 minutes and 4 seconds)
Acquisition speed : 7.81 MByte/s (0 hours, 0 minutes and 4 seconds)
Verification speed : 31.25 MByte/s (0 hours, 0 minutes and 1 seconds)
Generated image files and their MD5 hashes
==========================================
No MD5 hashes available (configuration parameter CalcImageFileMD5 is off)
MD5 Image file
n/a sm32mblin.000

BIN
images/sm32mbmac.dd Executable file
View File

Binary file not shown.

45
images/sm32mbmac.dd.txt Executable file
View File

@ -0,0 +1,45 @@
Created By AccessData® FTK® Imager 3.1.1.8
Case Information:
Acquired using: ADI3.1.1.8
Case Number: 20170301
Evidence Number: 8
Unique description: sm32mbmac
Examiner: Patrick Neumann
Notes: fatmapper test device (macOS)
--------------------------------------------------------------
Information for C:\Users\Patrick Neumann\Desktop\sm32mbmac:
Physical Evidentiary Item (Source) Information:
[Device Info]
Source Type: Physical
[Drive Geometry]
Cylinders: 3
Tracks per Cylinder: 255
Sectors per Track: 63
Bytes per Sector: 512
Sector Count: 64.000
[Physical Drive Information]
Drive Model: Generic USB SM Reader USB Device
Drive Serial Number: 058F312D812
Drive Interface Type: USB
Removable drive: True
Source data size: 31 MB
Sector count: 64000
[Computed Hashes]
MD5 checksum: 86b7cafaab98751338f6efb817802324
SHA1 checksum: 5d6ba021d9f6a2ca3aca817ec7cf20e7ee05bf16
Image Information:
Acquisition started: Wed Mar 01 14:50:43 2017
Acquisition finished: Wed Mar 01 14:50:52 2017
Segment list:
C:\Users\Patrick Neumann\Desktop\sm32mbmac.001
Image Verification Results:
Verification started: Wed Mar 01 14:50:52 2017
Verification finished: Wed Mar 01 14:50:52 2017
MD5 checksum: 86b7cafaab98751338f6efb817802324 : verified
SHA1 checksum: 5d6ba021d9f6a2ca3aca817ec7cf20e7ee05bf16 : verified

BIN
images/sm32mbwin.dd Executable file
View File

Binary file not shown.

45
images/sm32mbwin.dd.txt Executable file
View File

@ -0,0 +1,45 @@
Created By AccessData® FTK® Imager 3.1.1.8
Case Information:
Acquired using: ADI3.1.1.8
Case Number: 20170301
Evidence Number: 5
Unique description: sm32mb
Examiner: Patrick Neumann
Notes: fatmapper test device
--------------------------------------------------------------
Information for C:\Users\Patrick Neumann\Desktop\sm32mb:
Physical Evidentiary Item (Source) Information:
[Device Info]
Source Type: Physical
[Drive Geometry]
Cylinders: 3
Tracks per Cylinder: 255
Sectors per Track: 63
Bytes per Sector: 512
Sector Count: 64.000
[Physical Drive Information]
Drive Model: Generic USB SM Reader USB Device
Drive Serial Number: 058F312D812
Drive Interface Type: USB
Removable drive: True
Source data size: 31 MB
Sector count: 64000
[Computed Hashes]
MD5 checksum: a350f05a57e1cd945bda0ed106080f1b
SHA1 checksum: 96a3610c7af62103ee91285db25eb239beff34a4
Image Information:
Acquisition started: Wed Mar 01 14:36:15 2017
Acquisition finished: Wed Mar 01 14:36:24 2017
Segment list:
C:\Users\Patrick Neumann\Desktop\sm32mb.001
Image Verification Results:
Verification started: Wed Mar 01 14:36:24 2017
Verification finished: Wed Mar 01 14:36:24 2017
MD5 checksum: a350f05a57e1cd945bda0ed106080f1b : verified
SHA1 checksum: 96a3610c7af62103ee91285db25eb239beff34a4 : verified