Introduction

The Standard Tests are outlined here. The test cases were designed so that the tool design could be learned. As is shown, just because a tool does not find a string, does not mean that the tool has a bug. The test image is a FAT file system with 1 cluster per sector.

Description

The index numbers in this list correspond to the test number.

1. The 'first' string is in the allocated space of a cluster. If this string is found, then the tool likely examines the allocated space of a cluster.
2. The 'SECOND' string is in the allocated space of a cluster. The string also exists in the directory entry listings because a file exists with the same name. If this string is found twice, then the tool likely searches the meta data structures in addition to just the data area.
3. The '1cross1' string starts in the allocated space of a cluster of one file and ends in the next consecutive cluster, which is allocated to a second file. If this string is found, then the tool likely looks at all clusters together for the string.
4. The '2cross2' string starts in the allocated space of one cluster in a file and ends in the next consecutive cluster, which is allocated to the same file. If this string is found, then the tool either looks at all clusters at a time or reconstructs the files before searching them. See string 9 for a related test.
5. The '3cross3' string starts at the end of one unallocated cluster and ends in the next consecutive cluster, which is also unallocated. If this string is found, then the tool likely searches unallocated space as a large chunk of data and not each cluster individually.
6. The '1slack1' string starts in the allocated space of a cluster and ends in the slack space of the same cluster. If this string is found, then the tool likely does not use the file boundaries within a cluster to find the string.
7. The '2slack2' string starts in the slack space of a file and ends in the allocated space of the next consecutive cluster, which is allocated to a different file. If this string is found, then the tool likely does not use file boundaries to find the string.
8. The '3slack3' string starts and ends in the slack space of a file. If this string is found, then the tool likely examines the slack space during the search.
9. The '1fragment1' string starts at the end of a cluster in a file and ends in the next cluster of the file. The two cluster are fragmented though. If this string is found, then the tool likely puts the clusters of the file together before performing the search.
10. The '2fragment sentence2' string starts at the end of one cluster in a file and ends in the next cluster of the file. The two cluster are fragmented and the space is the last value in the first cluster. If this string is found, then the tool likely puts the clusters of the file together before performing the search.
11. The 'deleted' string starts and ends in an unallocated cluster. If this string is found, then the tool likely examines the unallocated space of the image when searching for the string.
12. The 'a?b\c*d$e#f[g^' string starts and ends in the allocated space of a cluster. If this is found, then the tool likely escapes grep regular expression values properly (if needed).

References