File Carving based Digital Forensic Tools Testing Data Sets (Contiguous Files)

The test image is a NTFS file system and is intended to test data carving tools and their ability to extract various file formats. The image contains several allocated and deleted files that are all stored in contiguous format within its allocated space. All files are random files that that were in my possession or that I created from scratch. This image was created from a NAND USB thumb-drive that was wiped and formatted using the Forensic Toolkit FTK Imager with the file extension of AD1. The image has been eliminated with its meta data so that it cannot be mounted and therefore data carving methods must be used to extract the files. This test image is a 'raw' image (i.e. 'dd') of a NTFS file system. The file system is 2 GB. The MD5, SHA, file types, name of every file and all other details of the image are clearly mentioned in the .csv and .txt files attached to this data set. One can run the image against any data carving based tool and thus can cross check the obtained values with that of our image.本测试镜像为NTFS(NTFS)文件系统镜像，专为测试数据 carving（data carving）工具及其对多类文件格式的提取能力而设计。该镜像包含若干已分配与已删除文件，所有文件均以连续存储格式存放于其分配空间内。所有文件均为本人自有或从零自主创建的随机文件。本镜像源自一块经擦除并格式化的NAND闪存式USBU盘，采用取证工具包FTK Imager(Forensic Toolkit FTK Imager)制作，文件扩展名为AD1。该镜像已清除元数据，无法被挂载，因此必须通过数据 carving 方法提取其中的文件。本测试镜像是NTFS文件系统的原始(raw)镜像（即dd镜像）。该文件系统容量为2GB。本镜像的MD5哈希值、SHA哈希值、各类文件类型、所有文件名及其他所有详细信息，均已在本数据集附带的.csv与.txt文件中明确列明。用户可将该镜像与任意基于数据 carving 的工具进行测试，并将提取得到的各项结果与本镜像的预设参数进行交叉验证。