CFTT Raw Test Files

Overview

This page allows access to the raw log files generated during CFTT tool testing.

NOTE: WE are still in the process of posting log files. If the files you want are not posted, contact us at cftt [at] nist.gov (cftt[at]nist[dot]gov).

The raw files provide interested parties with the ability to examine the data used to create a CFTT tool test report. The usual procedure to access the raw files is as follows:
 

• Select the report of interest (bzipped tar file) containing all the test case run directories and any setup directory. Reports are categorized by the functionality, currently disk imaging, write blocking, drive erasing, file carving, and deleted file recovery.
• The bz file can be opened on either a Mac or a Linux system. Windows users can uncompress the files by downloading 7-zip (www.7-zip.org/download.html).
• For help understanding the setup or analysis logs, see the documentation provided with the test support software.  All software and documentation are available at www.cftt.nist.gov.  They are grouped by functionality being tested (e.g., disk imaging, write blocking, etc.).
• Contact CFTT cftt [at] nist.gov (cftt[at]nist[dot]gov) for additional explanation as needed. We are always happy to assist.

Disk Imaging Reports

NOTE:  The SHA-256 hashes are available for the files listed below.

The setup files describing the source drives used in disk imaging tests.

Solo-4
IxImager 3
Encase 7.04
Fast Disk Acquisition System (FDAS) 2.0.2 (July 2013)
FTK Imager CLI 2.9.0_Debian (May 2013)
Paladin 3.0 (March 2013)
Paladin 2.06 (March 2013)
X-Ways Forensic 14.8 (March 2013)
ASR Data SMART version 2010-11-03 (October 2012)
VOOM HardCopy 3P -- Firmware Version 2-04 (October 2012)
Imager MASSter Solo-3 Forensics; Software Version 2.0.10.23f (December 2011)
Tableau TD1 Forensic Duplicator; Firmware Version 2.34 Feb. 17, 2011 (December 2011)
ASR Data SMART version 2010-11-03 (September 2011)
Tableau Imager (TIM) Version 1.11 (March 2011)
SubRosaSoft MacForensics Lab 2.5.5 (September 2010)
Logicube Forensic Talon Software Version 2.43 (January 2010)
BlackBag MacQuisition 2.2 (September 2009)
EnCase 6.5 (September 2009)
EnCase LinEn 6.01 (October 2008)
EnCase 5.05f (June 2008)
FTK Imager 2.5.3.14 (June 2008)
DCCIdd (Version 2.0, June 1 2007) (January 2008)
EnCase 4.22a (January 2008)
Encase Linen 5.05f (January 2008)
IXimager (Version 2.0, Feb-01 2006) (April 2007)
dd FreeBSD (January 2004)
Encase 3.20 (June 2003)
Safeback 2.18 (June 2003)
Safeback (Sydex) 2.0 (April 2003)
dd GNU fileutils 4.0.36, Provided with Red Hat Linux 7.1 (August 2002)

Write Block Reports

T4 Forensic SCSI Bridge (FireWire Interface) (September 2009)
T4 Forensic SCSI Bridge (USB Interface) (September 2009)
Tableau T8 Forensic USB Bridge (FireWire Interface) (August 2008)
Tableau T8 Foresnic USB Bridge (USB Interface) (August 2008)
FastBloc FE (USB Interface) (June 2007)
FastBloc FE (FireWire Interface) (June 2007)
Tableau T5 Forensic IDE Bridge (USB Interface) (June 2007)
Tableau T5 Forensic IDE Bridge (FireWire Interface) (June 2007)
Tableau Forensic SATA Bridge T3u (USB Interface) (January 2007)
Tableau Forensic SATA Bridge T3u (FireWire Interface) (January 2007)
Tableau Forensic IDE Pocket Bridge T14 (FireWire Interface) (January 2007)
WiebeTech Forensic SATADock (FireWire Interface) (December 2006)
WiebeTech Forensic SATADock (USB Interface) (December 2006)
WiebeTech Forensic ComboDock (USB Interface) (May 2006)
WiebeTech Forensic ComboDock (FireWire Interface) (May 2006)
WiebeTech Bus Powered Forensic ComboDock (USB Interface) (May 2006)
WiebeTech Bus Powered Forensic Come Interface) (May 2006)
Digital Intelligence UltraBlock SATA (FireWire Interface) (May 2006)
FastBloc IDE (Firmware Version 16) (April 2006)
MyKey NoWrite (Firmware Version 1.05) (April 2006)
ICS ImageMasster DriveLock IDE (Firmware Version 17) (April 2006)
WiebeTech FireWire DriveDock Combo (FireWire Interface) (April 2006)
Digital Intelligence Firefly 800 IDE (FireWire Interface) (April 2006)
Digital Intelligence UltraBlock SATA (USB Interface) (April 2006)

Drive Erase Reports

dcc3dd Version 7.0.0 (December 2011)
Image MASSter Solo-4 Forensics; Software Version 4.2.63.0 (December 2011)
Tableau TDW1 Drive Tool/Drive Wiper; Firmware Version 04/07/10 18:21:33 (December 2011)
Disk Jockey PRO Forensic Edition (version 1.20) (October 2010)
Drive eRazor Pro SE Bundle 12/03/2009 (September 2010)
Tableau Forensic Duplicator Model TD1 (Firmware Version 3.10) (September 2010)
Logicube Omniclone 2Xi (June 2010)
Darik's Boot and Nuke 1.0.7 (January 2010)
Voom HardCopy II (Model XLHCPL-2PD Version 1-11) (January 2010)
WiebeTech Drive eRazer: DRZR-2-VBND & Drive eRazer PRO Bundle (September 2009)

File Carving Reports

Pending

Deleted File Recovery Reports

Pending