NCJ Number
221167
Date Published
January 2008
Length
67 pages
Annotation
This report presents the results of testing the EnCase Linen Version 5.05f digital data acquisition tool used in computer forensic investigations.
Abstract
Results of the testing indicate that except for two test cases (DA-08 and DA-09) the EnCase Linen Version 5.05f acquired all visible and hidden sectors completely and accurately from the test media. The two exceptions are the following: (1) up to seven sectors contiguous to a defective sector may be replaced by zeros in the acquisition (DA-09-1 and DA-09-2); and (2) the sectors hidden by a device configuration overlay (DCO) are not acquired (DA-08-DCO). The EnCase Linen Version 5.05f is a digital data acquisition tool used in computer forensic investigations. The Computer Forensics Tool Testing (CFTT), a joint project of the U.S. Department of Justice, National Institute of Justice (NIJ), and the National Institute of Standards and Technology's (NIST's) Office of Law Enforcement Standards (OLES) and Information Technology Laboratory (ITL), provides measurable assurance to practitioners, researchers, and others that the tools used in computer forensics investigations provide accurate results. This report presents the results from testing EnCase Linen Version 5.05f against the Digital Data Acquisition Tool Assertions and Test Plan Version 1.0.