As part of the Computer Forensics Tool Testing (CFTT) project, this report presents the results of testing a particular software tool (SafeBack 2.18) that copies or images computer hard-disk drives.
The objective of the CFTT project is to provide measurable assurance to practitioners, researchers, and other applicable users that the tools used in computer forensics investigations provide accurate results. This requires the development of specifications and test methods for computer forensics tools and subsequent testing of specific tools against those specifications. The test results are intended to provide information that is necessary for developers to improve tools, users to make informed choices, and the legal community and others to understand the tools' capabilities. The testing of SafeBack 2.18, a disk imaging tool, assessed the tool's ability to make a bit-stream duplicate or an image of an original disk or partition, to not alter the original disk, to log I/O errors, and to make an accurate documentation of the original disk or partition. The testing results found that SafeBack, with two exceptions, copied all the disk sectors accurately and completely in the test cases that were run. The two exceptions are identified and discussed. For all the test cases that were run, SafeBack never altered the original hard drive, and it always identified image files that had been modified. SafeBack always logged I/O errors for the test cases that were conducted. The tool documentation available was the SafeBack Reference Manual, Version 2.0, Second Edition, October 2001. There was no documentation identified for Version 2.18. In some cases, the software behavior was not documented or was ambiguous. Detailed test data are provided.