File Carving based Digital Forensic Tools Testing Data Sets (Contiguous Files)

The test image is a NTFS file system and is intended to test data carving tools and their ability to extract various file formats. The image contains several allocated and deleted files that are all stored in contiguous format within its allocated space. All files are random files that that were in my possession or that I created from scratch. This image was created from a NAND USB thumb-drive that was wiped and formatted using the Forensic Toolkit FTK Imager with the file extension of AD1. The image has been eliminated with its meta data so that it cannot be mounted and therefore data carving methods must be used to extract the files. This test image is a 'raw' image (i.e. 'dd') of a NTFS file system. The file system is 2 GB. The MD5, SHA, file types, name of every file and all other details of the image are clearly mentioned in the .csv and .txt files attached to this data set. One can run the image against any data carving based tool and thus can cross check the obtained values with that of our image.

该测试镜像为NTFS文件系统，旨在测试数据雕刻工具（data carving tools）及其提取多种文件格式的能力。镜像中包含若干已分配和已删除的文件，这些文件在其分配空间内均以连续格式存储。所有文件均为随机文件，要么是我持有的文件，要么是我从头创建的文件。该镜像由一块NAND USB闪存盘生成，此闪存盘已通过取证工具包FTK Imager进行擦除和格式化，文件扩展名为AD1。该镜像的元数据已被移除，因此无法挂载，必须使用数据雕刻方法（data carving methods）提取文件。该测试镜像为NTFS文件系统的“原始”镜像（即“dd”镜像）。文件系统大小为2 GB。镜像的MD5、SHA、文件类型、每个文件的名称及所有其他细节均在随数据集附带的.csv和.txt文件中明确列出。可将该镜像用于任何基于数据雕刻的工具，并将所得结果与本镜像的对应结果进行交叉验证。