NCJ Number
228228
Date Published
September 2009
Length
42 pages
Annotation
Test results are presented on the WiebeTech Drive eRazer, a forensic media preparation tool under the Computer Forensics Tool Testing (CFTT) program.
Abstract
In all the test cases with both the Drive eRazer, version DRZR-2 and the eRazer PRO devices, all visible sectors were successfully overwritten. The test cases that used drives containing an HPA or DCO demonstrated some inconsistent behaviors which included: 1) with the jumper set to single pass mode, an HPA was removed, but content was not changed; 2) with the jumper set to single pass mode, a DCO was neither removed nor was the content changed; 3) with the jumper set to secure erase mode, a DCO was neither removed nor was the content changed; and 4) with the jumper set to secure erase mode, an HPA was not removed. The Computer Forensics Tool Testing (CFTT) program, a joint project of the National Institute of Justice (NIJ) and the National Institute of Standards and Technology's, Office of Law Enforcement Standards and Information Technology Laboratory seeks to provide measurable assurance to practitioners, researchers, and other applicable users that the tools used in computer forensics investigations provide accurate results. This document reports the results from testing WiebeTech Drive eRazer, against the Forensic Media Preparation Tool Test Assertions and Test Plan Version 1.0. Two versions of the Drive eRazer were tested: DRZR-2VRND and Drive eRazer Pro Bundle. Due to the DRZR-2-VBND device failing to recognize certain drives as supporting SECURE ERASE, the eRazer PRO was then included. The eRazer PRO has revised firmware that fixes the recognition problem, but is otherwise the same as the original device. Figures