2 Test Case Selection

Not all test cases or test assertions specified in the Digital Data Acquisition Tool Assertions and Test Plan Version 1.0 are appropriate for all tools. In addition to the base test cases, each remaining test case is linked to optional tool features needed for the test case. If a given tool implements a given feature then the test cases linked to that feature are run. Table 1 lists the features available in MacQuisition and the linked test cases. Table 2 lists the features not available in MacQuisition and the linked test cases that were not run.
Table 1 Selected Test Cases
Supported Optional Feature Base Cases Read error during acquisition Create an image file in more than one format Insufficient space for image file
Table 2 Omitted Test Cases
Cases selected for execution 06, 07 & 10 12
Unsupported Optional Feature Create a clone during acquisition Create cylinder aligned clones Convert an image file from one format to another Destination Device Switching Device I/O error generator available Fill excess sectors on a clone device Create a clone from an image file Create a clone from a subset of an image file Detect a corrupted (or changed) image file
Cases omitted (not executed) 01, 02 & 04 03, 15, 21 & 13 05, 11 & 18 19, 20, 21, 22 & & 24 & 25
Some test cases have variant forms to accommodate parameters within test assertions.
These variations cover the execution environment, acquisition interface to the source
February of 62 Results for MacQuisition 2.2
drive, and type of digital object acquired. Variations were also created for each imaging method. Execution was tested with both Intel and PowerPC architectures. The MacQuisition 2.2 tool does support both Intel and PowerPC architectures. Test cases whose names include the INTEL suffix (e.g., DA09134INTEL) were run using the Intel architecture. Test cases whose names do not include the INTEL suffix were run using the PowerPC architecture. The following source interfaces were tested: SATA28, SATA48, USB, and FireWire. The image files were created on FAT32 and HFS+ partitions.
3 Test Execution Approach
There are several ways to perform an acquisition using the MacQuisition tool. At a high level there is an intuitive GUI driven approach and a manual command line approach. The command line approach involves the user executing commands from the tools Quick Terminal program. The GUI-driven approach involves the user navigating through a series of windows to accomplish the acquisition. Several distinct program execution paths may be taken through these windows. To accomplish a rigorous testing of the tool procedures A through F were defined and used in testing. Procedures A through E specify distinct paths through the GUI-driven acquisition process. Procedure F specifies a command line acquisition. These procedures are defined in the Media Setup and Test Procedures for Disk Imaging document, which is available at the CFTT Web site (http://www.cftt.nist.gov/)

4 Results by Test Assertion
Table 3 summarizes the test results by assertion. The column labeled Assertions Tested gives the text of each assertion. The column labeled Tests gives the number of test cases that use the given assertion. The column labeled Anomaly gives the section number in this report where any observed anomalies are discussed. Two test assertions only apply in special circumstances. The assertion AO22 is checked only for tools that create block hashes. For MacQuisition, this optional computation was only tested in 11 test cases. The assertion AO24 is only checked if the tool is executed in a run time environment that does not modify attached storage devices, such as MS DOS. In normal operation an imaging tool is used in conjunction with a write block device to protect the source drive; however a blocker was not used during the tests so that assertion AO24 could be checked.

4 of 62

Table 3 Assertions Tested Assertions Tested AM01 The tool uses access interface SRCAI to access the digital source. AM-02 The tool acquires digital source DS. AM-03 The tool executes in execution environment XE. AM-05 If image file creation is specified, the tool creates an image file on file system type FS. AM-06 All visible sectors are acquired from the digital source. AM-07 All hidden sectors are acquired from the digital source. AM-08 All sectors acquired from the digital source are acquired accurately. AM-09 If unresolved errors occur while reading from the selected digital source, the tool notifies the user of the error type and location within the digital source. AM-10 If unresolved errors occur while reading from the selected digital source, the tool uses a benign fill in the destination object in place of the inaccessible data. AO-01 If the tool creates an image file, the data represented by the image file is the same as the data acquired by the tool. AO-02 If an image file format is specified, the tool creates an image file in the specified format. AO-04 If the tool is creating an image file and there is insufficient space on the image destination device to contain the image file, the tool shall notify the user. AO-05 If the tool creates a multifile image of a requested size then all the individual files shall be no larger than the requested size. AO-22 If requested, the tool calculates block hashes for a specified block size during an acquisition for each block acquired from the digital source. AO-23 If the tool logs any log significant information, the information is accurately recorded in the log file. AO-24 If the tool executes in a forensically safe execution environment, the digital source is unchanged by the acquisition process. Tests 4.6 4.4 4.6 4.6 Anomaly

The MacQuisition tool gives the user three imaging methods. The default method utilizes DCFLDD 1.3.4 and the remaining methods, Hashwindow and TPipe, use DCFLDD 1.0.

4.1 Acquisition Hashes

More than one version of the MacQuisition 2.2 imaging tool has been distributed. One version calculates incorrect SHA1 acquisition hash values on the PowerPC architecture. This version was used in test cases DA06FW and DA06FWINTEL. The other version available was used for all other test cases. February of 62 Results for MacQuisition 2.2
The tools TPipe imaging method can produce incorrect acquisition hash values for test cases DA06SATA48, DA06SATA48INTEL, and DA08SATA48. In these cases the block size parameter does not evenly divide the size of the acquired device. In another case that used the TPipe imaging method, case DA10, the acquisition hash value is correct, but we observed that for this case the value of the block size parameter evenly divides the size of the acquired device. It may be the case that the hash values are correctly computed if the block size evenly divides the size of the acquired device.
4.2 Block Acquisition Hashes
The hashwindow imaging method did not log a block hash for the last block of data acquired. The tools DCFLDD 1.3.4 imaging method did not compute correct block hash values for test cases DA06FW, DA06FWINTEL, DA06USB, and DA06USBINTEL where the hash size was set to 4.7 GB. Block hashes are computed correctly using the DCFLDD 1.3.4 imaging method when the hash size is set to a value less than 4 GB. When the tool logs block hash values it also logs the range of data over which each block hash was computed. These ranges inaccurately identify the data hashed indicating that bytes used in the calculation of a given block hash were also used in the calculation of another block hash. For example, the first block hash for test case DA06SATA28 is logged as being computed over bytes 01048576000. The second block hash for the same test case is logged as being computed over bytes 10485760002097152000. The inaccuracy here is that byte 1048576000 was only used in the calculation of the second hash value and not the first.
4.3 Acquisition With Insufficient Space
When there is insufficient space on the destination media to completely acquire the source device incomplete log files are generated. This is seen in test case DA12 and is because the log files are stored on the destination media. A message stating Could not copy Acquisition log from /tmp Error code: 256 is displayed.
4.4 Acquisition of HPA and DCO
The tool does not remove either HPAs or DCOs. The tool did not acquire sectors hidden by an HPA or DCO in test cases DA08DCO, DA08SATA28, DA08SATA28 INTEL, and DA08SATA48.

4.5 Skip Request Ignored

MacQuisition 2.2 allows a subset of a source device to be acquired with the use of the skip and count parameters. The tool correctly limits the amount of data acquired according to the value of the count parameter, but does not skip data as directed by the skip parameter. This behavior is seen in test case DA07PART.

11 of 62

Test Case DA-06-FW MacQuisition Version 2.2 2E6036DE4630AB2D27EB000313CC2800C7632CA49427DB7B585C8A6B00E5FC9625600 - 19251199 B78EDCB181A1859620D788A37AA57560A4D8A9018E32D33F2032898CF1B4526A - 28876799 EDE8657D5712B75E232EC00E59EB2874572B738BB683BC0E3D7976242644ABAD. - 105881599 A57C14E7D9EAB403047EC6FBA970EC7C9A0F0F67E788C2DC1EA8A36D33FD86D105881600 - 115507199 9D8A076D3BBB3163E58663C1FF63C65B259B6A7ACA3A74962BB13C1FE37F7B115507200 - 117304991 1B598D46640210837ACA4D755984CECAD51754D496727EE76D252D490C205Ftotal sectors (60060155904 bytes) Model (SP0612N ) serial # () N Start LBA Length Start C/H/S End C/H/S boot Partition type 1 P 0000/001/01 0260/254/63 Boot 06 FatX 0261/000/01 1023/254/63 0F extended 3 S 0261/001/01 1023/254/63 0B FatS 0000/000/00 0000/000/empty entry 5 P 0000/000/00 0000/000/empty entry 6 P 0000/000/00 0000/000/empty entry sectors 2146765824 bytes sectors 57905938944 bytes Log Highlights:
Tool hashes, Win size: 4928307200 bytes (9625600 sectors), 95 hash blocks - 4928307200: 0f96e8b06a62b0eccef8fb52423750eb - 4928307200: cc0a4bceab659e1882684ef14a377489fa9cfc5f - 4928307200: 1da75f52de5686d0cafb336a5ebd6b3b8774bd3bc4ce7f687949e1c9199c5ada - 9856614400: 98d0bcc3acf20bc1cf2000a87fb38d4928307200 - 9856614400: bdb360b829cb4ba413d0d356a7597d52475d78a4928307200 - 9856614400: 4f8262566c624ecdf3646dfc7e4280db50ba3fff8fb7613afa8aefae5f86d3bf - 14784921600: 194f06135923b6216f99e3ce02fbcf9856614400 - 14784921600: 5aac59a0ed91da5dcdcee1917e21427b009b95a9856614400 - 14784921600: b3381d95f1dc3d1f46850c53687087ae769a234c9defd211376c1d318a142baf. - 458332569600: c740178717b9f1b3417c9db86dd4c7b453404262400 - 458332569600: 06750c312617e2a69fbbf1fff2fdbe6b1f0e391b - 458332569600: 435cb952180e56f9fa974ed67f4e56781ace6f1ed378d6cbc829074da62ffdce - 463260876800: 7f69957ace5d9c9169cd565bb409b51c - 463260876800: fef70106ca351762cc5da224e0ceba1b663fe458332569600 - 463260876800: 864479b9675434bf86c3aef91dc4a24d23a4a1759a864bbac586b414dd515a8b - 463787081728: aaa9cd144524404f697b7877158f793c - 463787081728: f2dc9c2cbccdc8d338f72e161ea0435566f9d80a - 463787081728: 38f55b02271da8bd33471e180590ca9ad0f5b12982005c0c11834abde9909678 Entire Drive hashes Total (md5): ee217bc4fa4f3d1b4021d29b065aa9ec Total (sha1): 3cfe209944898b337d832c96c5203cabca3bc761 Total (sha256): ec8ef011494ba6da18f74c47547c3e74e7180585096a830f9247a98ef613bb1d Command Line: /Applications/MacQuisition_2.2UB.app/Contents/MacOS/newdcfldd/dcfldd if=/dev/disk1 status=off bs=4096 errlog=/tmp/mnt1/DA-06-FW/Admin/errorlog.txt hashwindow=4700M hash=md5,sha1,sha256 hashlog=/tmp/mnt1/DA-06-FW/Admin/hashlog.txt conv=noerror,sync split=4700M splitformat=nnn of=/tmp/mnt1/DA-06-FW/Images/IMAGE_0001 Source Device: /dev/disk1 FIREWIRE DMI SAMSUNG SP0612N - 55.94 GB Source Device Size: 60060155904 Bytes 117304992 Sectors Destination Device: /dev/disk0 SATA ST3320620AS - 298.09 GB Hash Options: MD5,SHA1,SHA256 Segmentation: 4700M Block Size: 4096 Bytes

5 14:45 IMAGE_0001.002.dmgpart 5 14:54 IMAGE_0001.003.dmgpart

15 of 62

Test Case DA-06-FW-INTEL MacQuisition Version 4928307200 Jan 5. 4928307200 Jan Jan Jan 5 Results:
2.2 15:03 IMAGE_0001.004.dmgpart 16:14 IMAGE_0001.012.dmgpart 16:15 IMAGE_0001.013.dmgpart 14:37 IMAGE_0001.dmg
Assertion & Expected Result AM-01 Source acquired using interface AI. AM-02 Source is type DS. AM-03 Execution environment is XE. AM-05 An image is created on file system type FS. AM-06 All visible sectors acquired. AM-08 All sectors accurately acquired. AO-01 Image file is complete and accurate. AO-05 Multifile image created. AO-22 Tool calculates hashes by block. AO-23 Logged information is correct. AO-24 Source is unchanged by acquisition.
Actual Result as expected as expected as expected as expected as expected as expected as expected as expected block hashes incorrect as expected as expected

16 of 62

6.2.3 DA-06-SATA28
Test Case DA-06-SATA28 MacQuisition Version 2.2 Case DA-06 Acquire a physical device using access interface AI to an image file. Summary: Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. AM-02 The tool acquires digital source DS. AM-03 The tool executes in execution environment XE. AM-05 If image file creation is specified, the tool creates an image file on file system type FS. AM-06 All visible sectors are acquired from the digital source. AM-08 All sectors acquired from the digital source are acquired accurately. AO-01 If the tool creates an image file, the data represented by the image file is the same as the data acquired by the tool. AO-05 If the tool creates a multi-file image of a requested size then all the individual files shall be no larger than the requested size. AO-22 If requested, the tool calculates block hashes for a specified block size during an acquisition for each block acquired from the digital source. AO-23 If the tool logs any log significant information, the information is accurately recorded in the log file. AO-24 If the tool executes in a forensically safe execution environment, the digital source is unchanged by the acquisition process. Tester Name: Test Host: Test Date: Drives: Source Setup: brl Richelieu Wed Feb 6 11:25:src(07-SATA) dst (none) other (1D-SATA) src hash (SHA1): < 655E9BDDB36A3F9C5C4CC8BF32B8C5B41AF9F52E > src hash (MD5): < 2EAF712DAD80F66E30DEA00365B4579B > Reference MD5 hashes, Win size: 2048000 (sectors) - 2047999 7461CFC14022754D4B0733B03872B2048000 - 4095999 31C720F0FFBE6537D0560A8E3B9EEAA4096000 - 6143999 F15DB36BC5B456C7877E1F8CAFD67701. - 153599999 7DDBFA56FEA4FF137651163017F613C153600000 - 155647999 CF24E1CE3D3086BA520893E38B3E155648000 - 156301487 0CB5C3EDE20AB493D5A995F6EF2C6BEtotal sectors (80026361856 bytes) Model (WDC WD800JD-32HK) serial # (WD-WMAJ91510044) N Start LBA Length Start C/H/S End C/H/S boot Partition type 1 P 0000/001/01 1023/254/63 Boot 07 NTFS 2 P 0000/000/00 0000/000/empty entry 3 P 0000/000/00 0000/000/empty entry 4 P 0000/000/00 0000/000/empty entry sectors 80015491584 bytes Log Highlights:

Tool hashes, Win size: 1048576000 bytes (2048000 sectors), 76 hash blocks - 1048576000: 7461cfc14022754d4b0733b03872b1048576000 - 2097152000: 31c720f0ffbe6537d0560a8e3b9eeaa2097152000 - 3145728000: f15db36bc5b456c7877e1f8cafd67701. - 77594624000: abc534d941446bf073d209fb6db15e3a - 78643200000: 7ddbfa56fea4ff137651163017f613c78643200000 - 79691776000: cf24e1ce3d3086ba520893e38b3e3431 Entire Drive hashes Total: 2eaf712dad80f66e30dea00365b4579b Command Line: /Applications/MacQuisition_2.2UB.app/Contents/MacOS/dcfldd if=/dev/disk0 status=off 2>/tmp/mnt1/DA_06_SATA28/Admin/errorlog.txt bs=4096 hashwindow=1000M hashlog=/tmp/mnt1/DA_06_SATA28/Admin/hashlog.txt conv=noerror,sync | /Applications/MacQuisition_2.2UB.app/Contents/MacOS/ddsplit - -m -b 1000m /tmp/mnt1/DA_06_SATA28/Images/IMAGE_0001 Source Device: /dev/disk0 ATA WDC WD800JD-32HKA0 - 74.53 GB Source Device Size: 80026361856 Bytes 156301488 Sectors Destination Device: /dev/disk1 SATA ST3320620AS - 298.09 GB

17 of 62

Test Case DA-06-SATA28 MacQuisition Version 2.2 Hash Options: MD5,SHA1,SHA256 Segmentation: 1000m Block Size: 4096 Bytes Hash Block Size: 1000M Imaging Method: Hashwindow DCFLDD 1.0 Source SHA1 rehash: 655E9BDDB36A3F9C5C4CC8BF32B8C5B41AF9F52E Settings: acquisition_procedure B bootMedia CF masterImage 2 hashwindow 1G Image file segments 3 1048576000. Results: Assertion & Expected Result AM-01 Source acquired using interface AI. AM-02 Source is type DS. AM-03 Execution environment is XE. AM-05 An image is created on file system type FS. AM-06 All visible sectors acquired. AM-08 All sectors accurately acquired. AO-01 Image file is complete and accurate. AO-05 Multifile image created. AO-22 Tool calculates hashes by block. AO-23 Logged information is correct. AO-24 Source is unchanged by acquisition. Actual Result as expected as expected as expected as expected as expected as expected as expected as expected last block hash missing as expected as expected

Feb Feb Feb Feb Feb Feb

6 04:22 IMAGE_0001.002.dmgpart 6 04:23 IMAGE_0001.003.dmgpart 6 04:24 IMAGE_0001.004.dmgpart 6 05:22 IMAGE_0001.076.dmgpart 6 05:22 IMAGE_0001.077.dmgpart 6 04:22 IMAGE_0001.dmg

18 of 62

6.2.4 DA-06-SATA48
Test Case DA-06-SATA48 MacQuisition Version 2.2 Case DA-06 Acquire a physical device using access interface AI to an image file. Summary: Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. AM-02 The tool acquires digital source DS. AM-03 The tool executes in execution environment XE. AM-05 If image file creation is specified, the tool creates an image file on file system type FS. AM-06 All visible sectors are acquired from the digital source. AM-08 All sectors acquired from the digital source are acquired accurately. AO-01 If the tool creates an image file, the data represented by the image file is the same as the data acquired by the tool. AO-05 If the tool creates a multi-file image of a requested size then all the individual files shall be no larger than the requested size. AO-22 If requested, the tool calculates block hashes for a specified block size during an acquisition for each block acquired from the digital source. AO-23 If the tool logs any log significant information, the information is accurately recorded in the log file. AO-24 If the tool executes in a forensically safe execution environment, the digital source is unchanged by the acquisition process. Tester Name: Test Host: Test Date: Drives: Source Setup: brl Richelieu Fri Feb 1 16:26:src(16-SATA) dst (none) other (1D-SATA) src hash (SHA1): < F82982A9C63133988C1D2B4DA7C9C25CCA2D77A5 > src hash (MD5): < 7BB1D64D47671ED3E69130A2AD08FA02 > 312581808 total sectors (160041885696 bytes) 19456/254/63 (max cyl/hd values) 19457/255/63 (number of cyl/hd) Model (WDC WD1600JD-00G) serial # (WD-WMAES2058252) N Start LBA Length Start C/H/S End C/H/S boot Partition type 1 P 0000/001/01 1023/254/63 Boot 07 NTFS 2 P 0000/000/00 0000/000/empty entry 3 P 0000/000/00 0000/000/empty entry 4 P 0000/000/00 0000/000/empty entry sectors 160031015424 bytes 1 5d542dc75c409345e4878683dc62342d Command Line: /Applications/MacQuisition_2.2UB.app/Contents/MacOS/dcfldd if=/dev/rdisk1 bs=65536 conv=noerror,sync | /Applications/MacQuisition_2.2UB.app/Contents/MacOS/tpipe "/Applications/MacQuisition_2.2UB.app/Contents/MacOS/md5sum > /tmp/mnt1/DA_06_SATA48/Admin/hashlog.txt" | /Applications/MacQuisition_2.2UB.app/Contents/MacOS/ddsplit - -m -b 700m /tmp/mnt1/DA_06_SATA48/Images/IMAGE_0001 2>/tmp/mnt1/DA_06_SATA48/Admin/errorlog.txt Source Device: /dev/rdisk1 ATA WDC WD1600JD-00GBB0 - 149.05 GB Source Device Size: 160041885696 Bytes 312581808 Sectors Destination Device: /dev/disk0 SATA ST3320620AS - 298.09 GB Hash Options: MD5,SHA1 Segmentation: 700m Block Size: 65536 Bytes Imaging Method: Tpipe DCFLDD 1.0 Source SHA1 rehash: F82982A9C63133988C1D2B4DA7C9C25CCA2D77A5 Settings: acquisition_procedure C bootMedia DVD masterImage 2 Image file segments Feb Feb Feb. Feb

Image file segments 734003200 Dec 19 17:37 IMAGE_0001.002.dmgpart 734003200 Dec 19 17:38 IMAGE_0001.003.dmgpart 734003200 Dec 19 17:39 IMAGE_0001.004.dmgpart.

21 of 62

Test Case DA-06-SATA48-INTEL MacQuisition 734003200 Dec 29229056 Dec 734003200 Dec Results:
Version 2.21:03 IMAGE_0001.218.dmgpart 19 21:03 IMAGE_0001.219.dmgpart 19 17:36 IMAGE_0001.dmg
Actual Result as expected as expected as expected as expected as expected as expected as expected as expected option not tested hash incorrect as expected

22 of 62

6.2.6 DA-06-USB
Test Case DA-06-USB MacQuisition Version 2.2 Case DA-06 Acquire a physical device using access interface AI to an image file. Summary: Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. AM-02 The tool acquires digital source DS. AM-03 The tool executes in execution environment XE. AM-05 If image file creation is specified, the tool creates an image file on file system type FS. AM-06 All visible sectors are acquired from the digital source. AM-08 All sectors acquired from the digital source are acquired accurately. AO-01 If the tool creates an image file, the data represented by the image file is the same as the data acquired by the tool. AO-05 If the tool creates a multi-file image of a requested size then all the individual files shall be no larger than the requested size. AO-22 If requested, the tool calculates block hashes for a specified block size during an acquisition for each block acquired from the digital source. AO-23 If the tool logs any log significant information, the information is accurately recorded in the log file. AO-24 If the tool executes in a forensically safe execution environment, the digital source is unchanged by the acquisition process. Tester Name: Test Host: Test Date: Drives: Source Setup: brl Richelieu Thu Jan 31 11:06:src(63-FU2) dst (none) other (1D-SATA) src hash (SHA256): < EC8EF011494BA6DA18F74C47547C3E74E7180585096A830F9247A98EF613BB1D > src hash (SHA1): < F7069EDCBEAC863C88DECED82159F22DA96BE99B > src hash (MD5): < EE217BC4FA4F3D1B4021D29B065AA9EC > Reference MD5 hashes, Win size: 9625600 (sectors) - 9625599 B9C76550A2E1799943F9F12B136B9625600 - 19251199 2266BDA23964E222F5175D4AE2B4C34B - 28876799 FCF4BBB5D26FF636E693D2891C6FC293. - 105881599 0DBF99A015945CEA99F5F520AFA8EA105881600 - 115507199 08C6525C99379415A1AF66DD0187BF1A - 117304991 834C625424E4F960AD1E63A8377D8900 Reference SHA1 hashes, Win size: 9625600 (sectors) - 9625599 909C72A0918E2189F2DC877B06237EC2DED6A76A - 19251199 01E1E92E8366E523A0883D001716EA19251200 - 28876799 803D84E0F6273BF4073C55C4B0D7A0CC37976F97. - 105881599 6F81F7B76DB8711E1379B92310C5B2A77C61D105881600 - 115507199 695DF444E6A5674913750098DFF042C3352F338D - 117304991 D755AE046965033076EA8CD8B580362B02262FD8 Reference SHA256 hashes, Win size: 9625600 (sectors) - 9625599 2E6036DE4630AB2D27EB000313CC2800C7632CA49427DB7B585C8A6B00E5FC9625600 - 19251199 B78EDCB181A1859620D788A37AA57560A4D8A9018E32D33F2032898CF1B4526A - 28876799 EDE8657D5712B75E232EC00E59EB2874572B738BB683BC0E3D7976242644ABAD. - 105881599 A57C14E7D9EAB403047EC6FBA970EC7C9A0F0F67E788C2DC1EA8A36D33FD86D105881600 - 115507199 9D8A076D3BBB3163E58663C1FF63C65B259B6A7ACA3A74962BB13C1FE37F7B115507200 - 117304991 1B598D46640210837ACA4D755984CECAD51754D496727EE76D252D490C205Ftotal sectors (60060155904 bytes) Model (SP0612N ) serial # () N Start LBA Length Start C/H/S End C/H/S boot Partition type 1 P 0000/001/01 0260/254/63 Boot 06 FatX 0261/000/01 1023/254/63 0F extended

24 of 62

Test Case DA-06-USB MacQuisition. Results:
Version 2.2 Jan 31 23:20./Images/IMAGE_0001.086.dmgpart Jan 31 23:27./Images/IMAGE_0001.087.dmgpart Jan 31 11:27./Images/IMAGE_0001.dmg

25 of 62

6.2.7 DA-06-USB-INTEL
Test Case DA-06-USB-INTEL MacQuisition Version 2.2 Case DA-06 Acquire a physical device using access interface AI to an image file. Summary: Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. AM-02 The tool acquires digital source DS. AM-03 The tool executes in execution environment XE. AM-05 If image file creation is specified, the tool creates an image file on file system type FS. AM-06 All visible sectors are acquired from the digital source. AM-08 All sectors acquired from the digital source are acquired accurately. AO-01 If the tool creates an image file, the data represented by the image file is the same as the data acquired by the tool. AO-05 If the tool creates a multi-file image of a requested size then all the individual files shall be no larger than the requested size. AO-22 If requested, the tool calculates block hashes for a specified block size during an acquisition for each block acquired from the digital source. AO-23 If the tool logs any log significant information, the information is accurately recorded in the log file. AO-24 If the tool executes in a forensically safe execution environment, the digital source is unchanged by the acquisition process. Tester Name: Test Host: Test Date: Drives: Source Setup: brl Manuelito Mon Dec 29 10:29:src(63-FU2) dst (none) other (3D-SATA) src hash (SHA256): < EC8EF011494BA6DA18F74C47547C3E74E7180585096A830F9247A98EF613BB1D > src hash (SHA1): < F7069EDCBEAC863C88DECED82159F22DA96BE99B > src hash (MD5): < EE217BC4FA4F3D1B4021D29B065AA9EC > Reference MD5 hashes, Win size: 9625600 (sectors) - 9625599 B9C76550A2E1799943F9F12B136B9625600 - 19251199 2266BDA23964E222F5175D4AE2B4C34B - 28876799 FCF4BBB5D26FF636E693D2891C6FC293. - 105881599 0DBF99A015945CEA99F5F520AFA8EA105881600 - 115507199 08C6525C99379415A1AF66DD0187BF1A - 117304991 834C625424E4F960AD1E63A8377D8900 Reference SHA1 hashes, Win size: 9625600 (sectors) - 9625599 909C72A0918E2189F2DC877B06237EC2DED6A76A - 19251199 01E1E92E8366E523A0883D001716EA19251200 - 28876799 803D84E0F6273BF4073C55C4B0D7A0CC37976F97. - 105881599 6F81F7B76DB8711E1379B92310C5B2A77C61D105881600 - 115507199 695DF444E6A5674913750098DFF042C3352F338D - 117304991 D755AE046965033076EA8CD8B580362B02262FD8 Reference SHA256 hashes, Win size: 9625600 (sectors) - 9625599 2E6036DE4630AB2D27EB000313CC2800C7632CA49427DB7B585C8A6B00E5FC9625600 - 19251199 B78EDCB181A1859620D788A37AA57560A4D8A9018E32D33F2032898CF1B4526A - 28876799 EDE8657D5712B75E232EC00E59EB2874572B738BB683BC0E3D7976242644ABAD. - 105881599 A57C14E7D9EAB403047EC6FBA970EC7C9A0F0F67E788C2DC1EA8A36D33FD86D105881600 - 115507199 9D8A076D3BBB3163E58663C1FF63C65B259B6A7ACA3A74962BB13C1FE37F7B115507200 - 117304991 1B598D46640210837ACA4D755984CECAD51754D496727EE76D252D490C205Ftotal sectors (60060155904 bytes) Model (SP0612N ) serial # () N Start LBA Length Start C/H/S End C/H/S boot Partition type 1 P 0000/001/01 0260/254/63 Boot 06 FatX 0261/000/01 1023/254/63 0F extended

26 of 62

Test Case DA-06-USB-INTEL MacQuisition Version 2.S 0261/001/01 1023/254/S 0000/000/00 0000/000/P 0000/000/00 0000/000/P 0000/000/00 0000/000/004192902 sectors 2146765824 bytes sectors 57905938944 bytes Log Highlights:
Tool hashes, Win size: 4928307200 bytes (9625600 sectors), 95 hash blocks - 4928307200: 0f96e8b06a62b0eccef8fb52423750eb - 4928307200: af41df3c21016755176307fff7d92c68fffa0 - 4928307200: 1da75f52de5686d0cafb336a5ebd6b3b8774bd3bc4ce7f687949e1c9199c5ada - 9856614400: 98d0bcc3acf20bc1cf2000a87fb38d4928307200 - 9856614400: ea1027ea03fbad3d6eb79c81d695d80d8b8654ae - 9856614400: 4f8262566c624ecdf3646dfc7e4280db50ba3fff8fb7613afa8aefae5f86d3bf - 14784921600: 194f06135923b6216f99e3ce02fbcf9856614400 - 14784921600: 2360131a08ca8be0f3d733fe84890a46b7a1edff - 14784921600: b3381d95f1dc3d1f46850c53687087ae769a234c9defd211376c1d318a142baf. - 458332569600: c740178717b9f1b3417c9db86dd4c7b453404262400 - 458332569600: e7a1ce0964cbb6c0c5d23ef8ff68030ee8cd7bfe - 458332569600: 435cb952180e56f9fa974ed67f4e56781ace6f1ed378d6cbc829074da62ffdce - 463260876800: 7f69957ace5d9c9169cd565bb409b51c - 463260876800: 44cfa4e8b3b800399099591eed6a330402724e458332569600 - 463260876800: 864479b9675434bf86c3aef91dc4a24d23a4a1759a864bbac586b414dd515a8b - 463787081728: aaa9cd144524404f697b7877158f793c - 463787081728: d8c6f3b1fa91d97ecc2d6fb34c9d863c356d0db463260876800 - 463787081728: 38f55b02271da8bd33471e180590ca9ad0f5b12982005c0c11834abde9909678 Entire Drive hashes Total (md5): ee217bc4fa4f3d1b4021d29b065aa9ec Total (sha1): f7069edcbeac863c88deced82159f22da96be99b Total (sha256): ec8ef011494ba6da18f74c47547c3e74e7180585096a830f9247a98ef613bb1d Command Line: /Applications/MacQuisition_2.2UB.app/Contents/MacOS/newdcfldd/dcfldd if=/dev/rdisk1 status=off bs=4096 errlog=/tmp/mnt1/DA_06_USB_INTEL/Admin/errorlog.txt hashwindow=4700M hash=md5,sha1,sha256 hashlog=/tmp/mnt1/DA_06_USB_INTEL/Admin/hashlog.txt conv=noerror,sync split=660M splitformat=nnn of=/tmp/mnt1/DA_06_USB_INTEL/Images/IMAGE_0001 Source Device: /dev/rdisk1 USB SAMSUNG SP0612N - 55.94 GB Source Device Size: 60060155904 Bytes 117304992 Sectors Destination Device: /dev/disk8 USB ST375033 0AS - 698.64 GB Hash Options: MD5,SHA1,SHA256 Segmentation: 660M Block Size: 4096 Bytes Imaging Method: New DCFLDD 1.3.4 Hash Values: TOTAL (MD5): EE217BC4FA4F3D1B4021D29B065AA9EC TOTAL (SHA1): F7069EDCBEAC863C88DECED82159F22DA96BE99B TOTAL (SHA256): EC8EF011494BA6DA18F74C47547C3E74E7180585096A830F9247A98EF613BB1D Source SHA1 rehash: F7069EDCBEAC863C88DECED82159F22DA96BE99B Settings: acquisition_procedure A bootMedia CF masterImage 2 hashwindow 4.7GB Image file segments 692060160 Dec 31 13:50 IMAGE_0001.002.dmgpart

Tool hashes, Win size: 258998272 bytes (505856 sectors), 1 hash blocks - 258998272: c843593624b2b3b878596d8760bTotal (md5): c843593624b2b3b878596d8760b19954 No acquisition log file Source SHA1 rehash: D68520EF74A336E49DCCF83815B7B08FDC53E38A Settings: acquisition_procedure F bootMedia DVD masterImage 2 hashwindow 2G Image file segments Jan 29 18:00 IMAGE_001.000
Results: Assertion & Expected Result AM-01 Source acquired using interface AI. AM-02 Source is type DS. AM-03 Execution environment is XE. AM-05 An image is created on file system type FS. AM-06 All visible sectors acquired. AM-08 All sectors accurately acquired. AO-01 Image file is complete and accurate. AO-05 Multifile image created. AO-22 Tool calculates hashes by block. AO-23 Logged information is correct. Actual Result as expected as expected as expected as expected as expected as expected as expected as expected option not tested as expected

33 of 62

Test Case DA-07-THUMB MacQuisition Version 2.2 AO-24 Source is unchanged by acquisition.

as expected

34 of 62

6.2.11

DA-08-DCO
Test Case DA-08-DCO MacQuisition Version 2.2 Case DA-08 Acquire a physical drive with hidden sectors to an image file. Summary: Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. AM-02 The tool acquires digital source DS. AM-03 The tool executes in execution environment XE. AM-05 If image file creation is specified, the tool creates an image file on file system type FS. AM-06 All visible sectors are acquired from the digital source. AM-07 All hidden sectors are acquired from the digital source. AM-08 All sectors acquired from the digital source are acquired accurately. AO-01 If the tool creates an image file, the data represented by the image file is the same as the data acquired by the tool. AO-05 If the tool creates a multi-file image of a requested size then all the individual files shall be no larger than the requested size. AO-22 If requested, the tool calculates block hashes for a specified block size during an acquisition for each block acquired from the digital source. AO-23 If the tool logs any log significant information, the information is accurately recorded in the log file. AO-24 If the tool executes in a forensically safe execution environment, the digital source is unchanged by the acquisition process. Tester Name: Test Host: Test Date: Drives: Source Setup: brl Richelieu Wed Feb 6 14:23:src(15-SATA) dst (none) other (1D-SATA) src hash (SHA1): < 76B22DDE84CE61F090791DDBB79057529AAF00E1 > src hash (MD5): < 9B4A9D124107819A9CE6F253FE7DC675 > Reference MD5 hashes, Win size: 8192000 (sectors) - 8191999 38956C56774D1272F07D5D3483C4D8192000 - 16383999 D17790220FE1E98698F9E9F207B86A16384000 - 24575999 15FF3FBFF3EA1F0FF2E193820264518A. - 147455999 FD7BE579B5DC787DE06A8A393CB4D8FD - 155647999 F75D182B5413F3A0F6BDEDBB7813D7C155648000 - 156301487 77717ED10E77A656FF7002F77Ftotal sectors (80026361856 bytes) Model (0JD-00HKA0 ) serial # (WD-WMAJ91513490) Hashes with DCO in place: md5: E5F8B277A39ED0F49794E9916CD62DD9 sha1.txt: AC64CF1B3736BB2FE40C14D871E6F207BC432C2F Log Highlights:

41 of 62

Test Case DA-08-SATA48 MacQuisition Version 2.2 /Applications/MacQuisition_2.2UB.app/Contents/MacOS/ddsplit - -m -b 1000m /tmp/mnt1/DA_08_SATA48/Images/IMAGE_0001 2>/tmp/mnt1/DA_08_SATA48/Admin/errorlog.txt Source Device: /dev/rdisk0 ATA ST3320620AS - 267.03 GB Source Device Size: 286720000512 Bytes 560000001 Sectors Destination Device: /dev/disk1 SATA ST3320620AS - 298.09 GB Hash Options: MD5 Segmentation: 1000m Block Size: 4096 Bytes Imaging Method: Tpipe DCFLDD 1.0 Source SHA1 rehash: EB1045B57DE7CDA28FE9504E3FA238D0B5DBC587 Settings: acquisition_procedure A bootMedia CF masterImage 2 Image file segments 3 1048576000. Results: Assertion & Expected Result AM-01 Source acquired using interface AI. AM-02 Source is type DS. AM-03 Execution environment is XE. AM-05 An image is created on file system type FS. AM-06 All visible sectors acquired. AM-07 All hidden sectors acquired. AM-08 All sectors accurately acquired. AO-01 Image file is complete and accurate. AO-05 Multifile image created. AO-22 Tool calculates hashes by block. AO-23 Logged information is correct. AO-24 Source is unchanged by acquisition. Actual Result as expected as expected as expected as expected as expected HPA not acquired as expected as expected as expected option not tested hash incorrect as expected
4 18:05 IMAGE_0001.002.dmgpart 4 18:06 IMAGE_0001.003.dmgpart 4 18:08 IMAGE_0001.004.dmgpart 5 01:17 IMAGE_0001.273.dmgpart 5 01:17 IMAGE_0001.274.dmgpart 4 18:03 IMAGE_0001.dmg

42 of 62

6.2.15

DA-09

Test Case DA-09 MacQuisition Version 2.2 Case DA-09 Acquire a digital source that has at least one faulty data sector. Summary: Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. AM-02 The tool acquires digital source DS. AM-03 The tool executes in execution environment XE. AM-05 If image file creation is specified, the tool creates an image file on file system type FS. AM-06 All visible sectors are acquired from the digital source. AM-08 All sectors acquired from the digital source are acquired accurately. AM-09 If unresolved errors occur while reading from the selected digital source, the tool notifies the user of the error type and location within the digital source. AM-10 If unresolved errors occur while reading from the selected digital source, the tool uses a benign fill in the destination object in place of the inaccessible data. AO-01 If the tool creates an image file, the data represented by the image file is the same as the data acquired by the tool. AO-05 If the tool creates a multi-file image of a requested size then all the individual files shall be no larger than the requested size. AO-22 If requested, the tool calculates block hashes for a specified block size during an acquisition for each block acquired from the digital source. AO-23 If the tool logs any log significant information, the information is accurately recorded in the log file. AO-24 If the tool executes in a forensically safe execution environment, the digital source is unchanged by the acquisition process. Tester Name: Test Host: Test Date: Drives: Source Setup: brl Richelieu Tue Feb 12 15:07:src(ED-BAD-CPR4) dst (none) other (1D-SATA) No before hash for ED-BAD-CPR4 Known Bad Sector List for ED-BAD-CPR4 Manufacturer: Maxtor Model: DiamondMax Plus 9 Serial Number: Y23EGSJE Capacity: 60GB Interface: SATA 35 faulty sectors 6160328, 6160362, 10041157, 10041995, 10118634, 10209448, 11256569, 14115689, 14778391, 14778392, 14778449, 14778479, 14778517, 14778518, 14778519, 14778520, 14778521, 14778551, 14778607, 14778626, 14778627, 14778650, 14778668, 14778669, 14778709, 14778727, 14778747, 14778772, 14778781, 14778870, 14778949, 14778953, 14779038, 14779113, 14779321 Log Highlights: Destination setup 156301488 sectors wiped with 30 Comparision of original to clone Sectors compared: 120103200 Sectors match: 6160328 Sectors differ: 113942872 Bytes differ: 718653317 Diffs range 6160328-120103199 Source (120103200) has 36198288 fewer sectors than destination (156301488) Zero fill: 0 Src Byte fill (ED): 0 Dst Byte fill (30): 36198288 Other fill: 0 Other no fill: 0 Zero fill range: Src fill range: Dst fill range: 120103200-156301487 Other fill range:

49 of 62

Test Case DA-09-134-INTEL MacQuisition Version 2.2 Src fill range:
Dst fill range: 120103232-156301487

Other fill range:

Other not filled range:
- 4294967296: 1e4296c039cc172ce6f6aa47ef42fb2e
- 4294967296: 093b90499abac238dea6b9062ff6fc6cc790c1e8
- 6442450944: 227bc70a12b79931ebb46c1d0869457a
- 6442450944: ac6def47a9f8a2d00a43432783bad28b76233f7a
. - 57982058496: 3529f7e3392c0df83488a9c51a8a55834574848 - 57982058496: 72d8aa81a83b3c4162968e47bb4b88828948dbf57982058496 - 60129542144: e5114dd22f0f992c3930a1d58cbaa48d - 60129542144: 5dbcedfe2c0d7740734be98e13a759178c2c4c7b - 61492215808: 773ca98e338428aa5da157100e60129542144 - 61492215808: 6e43fc55cd8fd6d96b5161b73fd7a38183f7f45b Entire Drive hashes Total (md5): 9ab6cdac9403d37945816ddfe8d461f4 Total (sha1): 3f5f1d8bdb63a84a41d3e2ae84d05147676b2449 Command Line: /Applications/MacQuisition_2.2UB.app/Contents/MacOS/newdcfldd/dcfldd if=/dev/rdisk0 status=off bs=32768 errlog=/tmp/mnt1/DA_09_134_INTEL/Admin/errorlog.txt hashwindow=2G hash=md5,sha1 hashlog=/tmp/mnt1/DA_09_134_INTEL/Admin/hashlog.txt conv=noerror,sync split=2G splitformat=nnn of=/tmp/mnt1/DA_09_134_INTEL/Images/IMAGE_0001 Source Device: /dev/rdisk0 OTHER Maxtor 6Y060M0 - 57.27 GB Source Device Size: 61492838400 Bytes 120103200 Sectors Destination Device: /dev/disk2 OTHER ST3750330AS - 698.64 GB Hash Options: MD5,SHA1 Segmentation: 2G Block Size: 32768 Bytes Imaging Method: New DCFLDD 1.3.4 Hash Values: TOTAL (MD5): 9AB6CDAC9403D37945816DDFE8D461F4 TOTAL (SHA1): 3F5F1D8BDB63A84A41D3E2AE84D05147676B2449 Read error summary 19 I/O errors logged 3 different run lengths observed in 10 runs 8 runs of length runs of length runs of length sectors differ 1216 zero filled and 0 varying non-zero filled 120103232 sectors (61492854784 bytes) imaged Settings: acquisition_procedure A bootMedia CF masterImage 2 hashwindow 2G Image file segments 2147483648. 2147483648 Results: Assertion & Expected Result AM-01 Source acquired using interface AI. AM-02 Source is type DS. AM-03 Execution environment is XE. Actual Result as expected as expected as expected
Dec 22 15:53./Images/IMAGE_0001.002.dmgpart Dec 22 15:56./Images/IMAGE_0001.003.dmgpart Dec 22 16:00./Images/IMAGE_0001.004.dmgpart Dec 22 16:35./Images/IMAGE_0001.028.dmgpart Dec 22 16:36./Images/IMAGE_0001.029.dmgpart Dec 22 15:52./Images/IMAGE_0001.dmg

50 of 62

Test Case DA-09-134-INTEL MacQuisition Version 2.2 AM-05 An image is created on file system type FS. AM-06 All visible sectors acquired. AM-08 All sectors accurately acquired. AM-09 Error logged. AM-10 Benign fill replaces inaccessible sectors. AO-01 Image file is complete and accurate. AO-05 Multifile image created. AO-22 Tool calculates hashes by block. AO-23 Logged information is correct. AO-24 Source is unchanged by acquisition.

55 of 62

Test Case DA-09-TPIPE MacQuisition Version 2.2 Other not filled range: 0 source read errors, 0 destination read errors 1 65018f7a77028fa15c756f63d8548824 Command Line: /Applications/MacQuisition_2.2UB.app/Contents/MacOS/dcfldd if=/dev/rdisk0 bs=512 conv=noerror,sync | /Applications/MacQuisition_2.2UB.app/Contents/MacOS/tpipe "/Applications/MacQuisition_2.2UB.app/Contents/MacOS/md5sum > /tmp/mnt1/DA-09-TPIPE/Admin/hashlog.txt" | /Applications/MacQuisition_2.2UB.app/Contents/MacOS/ddsplit - -m -b 1000m /tmp/mnt1/DA-09-TPIPE/Images/IMAGE_0001 2>/tmp/mnt1/DA-09-TPIPE/Admin/errorlog.txt Source Device: /dev/rdisk0 ATA Maxtor 6Y060M0 - 57.27 GB Source Device Size: 61492838400 Bytes 120103200 Sectors Destination Device: /dev/disk1 SATA ST3320620AS - 298.09 GB Hash Options: MD5,SHA1 Segmentation: 1000m Block Size: 512 Bytes Imaging Method: Tpipe DCFLDD 1.0 Read error summary 0 I/O errors logged 1 different run lengths observed in 1 runs 1 runs of length sectors differ 0 zero filled and 0 varying non-zero filled 120103170 sectors (61492823040 bytes) imaged Settings: acquisition_procedure A bootMedia CF masterImage 2 Image file segments 3 1048576000. Results: Assertion & Expected Result AM-01 Source acquired using interface AI. AM-02 Source is type DS. AM-03 Execution environment is XE. AM-05 An image is created on file system type FS. AM-06 All visible sectors acquired. AM-08 All sectors accurately acquired. AM-09 Error logged. AM-10 Benign fill replaces inaccessible sectors. AO-01 Image file is complete and accurate. AO-05 Multifile image created. AO-22 Tool calculates hashes by block. AO-23 Logged information is correct. AO-24 Source is unchanged by acquisition. Actual Result as expected as expected as expected as expected some sectors skipped some sectors differ error sectors not logged undetermined fill source as expected as expected option not tested as expected not checked
Feb 20 20:13 IMAGE_0001.002.dmgpart Feb 20 20:17 IMAGE_0001.003.dmgpart Feb 20 20:22 IMAGE_0001.004.dmgpart Feb 21 00:34 IMAGE_0001.058.dmgpart Feb 21 00:37 IMAGE_0001.059.dmgpart Feb 20 20:08 IMAGE_0001.dmg

56 of 62

6.2.20

DA-09-TPIPE-INTEL

Test Case DA-09-TPIPE-INTEL MacQuisition Version 2.2 Case DA-09 Acquire a digital source that has at least one faulty data sector. Summary: Assertions: AM-01 The tool uses access interface SRC-AI to access the digital source. AM-02 The tool acquires digital source DS. AM-03 The tool executes in execution environment XE. AM-05 If image file creation is specified, the tool creates an image file on file system type FS. AM-06 All visible sectors are acquired from the digital source. AM-08 All sectors acquired from the digital source are acquired accurately. AM-09 If unresolved errors occur while reading from the selected digital source, the tool notifies the user of the error type and location within the digital source. AM-10 If unresolved errors occur while reading from the selected digital source, the tool uses a benign fill in the destination object in place of the inaccessible data. AO-01 If the tool creates an image file, the data represented by the image file is the same as the data acquired by the tool. AO-05 If the tool creates a multi-file image of a requested size then all the individual files shall be no larger than the requested size. AO-22 If requested, the tool calculates block hashes for a specified block size during an acquisition for each block acquired from the digital source. AO-23 If the tool logs any log significant information, the information is accurately recorded in the log file. AO-24 If the tool executes in a forensically safe execution environment, the digital source is unchanged by the acquisition process. Tester Name: Test Host: Test Date: Drives: Source Setup: brl D'Artagnan Thu Jan 8 10:18:src(ED-BAD-CPR4) dst (4A-SATA) other (3D-SATA) No before hash for ED-BAD-CPR4 Known Bad Sector List for ED-BAD-CPR4 Manufacturer: Maxtor Model: DiamondMax Plus 9 Serial Number: Y23EGSJE Capacity: 60GB Interface: SATA 35 faulty sectors 6160328, 6160362, 10041157, 10041995, 10118634, 10209448, 11256569, 14115689, 14778391, 14778392, 14778449, 14778479, 14778517, 14778518, 14778519, 14778520, 14778521, 14778551, 14778607, 14778626, 14778627, 14778650, 14778668, 14778669, 14778709, 14778727, 14778747, 14778772, 14778781, 14778870, 14778949, 14778953, 14779038, 14779113, 14779321 Log Highlights: Destination setup 156301488 sectors wiped with 4A Comparision of original to clone Sectors compared: 120103200 Sectors match: 120103165 Sectors differ: 35 Bytes differ: 17863 Diffs range 6160328, 6160362, 10041157, 10041995, 10118634, 10209448, 11256569, 14115689, 14778391-14778392, 14778449, 14778479, 14778517-14778521, 14778551, 14778607, 14778626-14778627, 14778650, 14778668-14778669, 14778709, 14778727, 14778747, 14778772, 14778781, 14778870, 14778949, 14778953, 14779038, 14779113, 14779321 Source (120103200) has 36198288 fewer sectors than destination (156301488) Zero fill: 0 Src Byte fill (ED): 0 Dst Byte fill (4D): 0 Other fill (4A): 36198288

3. Making Computer Detect the New Device
Run the CMOS(BIOS) set-up program to detect the new hard disk drive.

SAMSUNG

HDD INSTALLATION GUIDE
1 Go into CMOS screen during the booting of the computer. 2 Make the computer detect the hard disk.
This product is a precision designed mechanism and is very sensitive to shock and electrostatic discharge (ESD). When storing, please avoid high temperature and humidity and use the origirnal ESD protection package in which the product was shipped at the time of purchase. Please handle the product carefully. Damaged or detached labels or any other components may directly cause product malfunction and void warranty. 1. Configuring your Hard Disk Drive (Master, Slave)
In case drive capacity is 32GB or more, please refer to bellow diagram.

General Pin Setting

For descriptive details of the program, refer to the computers users manual
If your computer supports IDE HDD Auto Detection, the hard disk drive will automatically be detected. If your computer does not support auto detect, go into the User Define Mode and by referring written information on the product, set the correct settings for Cylinder, Head, and Sector and if some Bios must be, set the HDD Mode to LBA. Save the changed details and exit.
Setting as Master All other Series Pin Setting

(AB + FH)

Setting as Slave

(BD + FH)

Cable Select

(BD + EF)

4. Partitioning and Formatting the Drive
Refer to your Operating System manual or system manual for partitioning and formatting.
Pin Setting (32 GB Clip Pin Setting)
5. Samsung World Wide Web Site
Additional information can be obtained at www.samsunghdd.com. Cable Select

(CD + EF)

Setting as Master

(AB + CD)

(CD + FH)
2. Installing Your Hard Disk Drive
Note: Turn off the system power !
Cover opening mechanism and the location of the hard disk drive may vary from one computer to another.
SAMSUNG ELECTRONICS CO., LTD. INFORMATION MEDIA BUSINESS STORAGE SYSTEM DIVISION HEAD OFFICE: 94-1, IM SOO-DONG, KUMI-CITY KYUNG BUK, KOREA 730-350 FAX : 82-54-479-5567 This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions : (1) this device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation. ' Samsung Electronics Co., Ltd. Printed in Korea. BF68-00099B Rev.03
Turn off the computer, unplug the external cables, and open computer cover. Mount the hard disk drive in the designated place in the computer with screws provided with the product. Connect 40 pin interface cable and power cable. Make sure that the direction of the cables are correct and matches the shape of the receptacles when connecting cables. Incorrect cable connection may damage the hard disk drive.

Number 1Pin