Testing in the public view is an important part of increasing confidence in software and hardware tools. Developing extensive and exhaustive tests for digital investigation tools is a lengthy and complex process, which the Computer Forensic Tool Testing (CFTT) group at NIST has taken on.

To fill the gap between extensive tests from NIST and no public tests, I have been developing small test cases. The following are file system and disk images for testing digital (computer) forensic analysis and acquisition tools. They were submitted to the Computer Forensic Tool Testing (CFTT) e-mail list on Yahoo! Groups. The results can be found in the CFTT list archives and in the Test Report Tracker.

Test Images:

1. Extended Partition Test (July '03)
2. FAT Keyword Search Test (Aug '03)
3. NTFS Keyword Search Test #1 (Oct '03)
4. EXT3FS Keyword Search Test #1 (Nov '03)
5. FAT Daylight Savings Test (Jan '04)
6. FAT Undelete Test #1 (Feb '04)
7. NTFS Undelete (and leap year) Test #1 (Feb '04)
8. JPEG Search Test #1 (Jun '04)
9. FAT Volume Label Test #1 (Aug '04)
10. NTFS Autodetect Test #1 (Jan '05)
11. Basic Data Carving Test #1 (Mar '05) (by Nick Mikus)
12. Basic Data Carving Test #2 (Mar '05) (by Nick Mikus)
13. Windows Memory Analysis #1 (Jan '06) (by Jesse Kornblum)
14. ISO9660 Interpretation Test #1 (Aug '10)

Test Results:

• Submission and Posting Requirements
• Report Tracker

Copyright © 2005-2010 by Brian Carrier Email: carrier <at> digital-evidence <dot> org

Last Updated: August 11, 2010