File Carving based Digital Forensic Tools Testing Data Sets (Contiguous Files)

This test image is a NTFS file system and is intended to test data carving tools and their ability to extract various file formats. The image contains several allocated and deleted files that are all stored in contiguous format within its allocated space. All files are random files that that were in my possession or that I created from scratch. This image was created from a NAND USB thumb-drive that was wiped and formatted using the Forensic Toolkit FTK Imager with the file extension of AD1. The image has been eliminated with its meta data so that it cannot be mounted and therefore data carving methods must be used to extract the files. This test image is a 'raw' image (i.e. 'dd') of a NTFS file system. The file system is 2 GB. The MD5, SHA, file types, name of every file and all other details of the image are clearly mentioned in the .csv and .txt files attached to this data set. One can run the image against any data carving based tool and thus can cross check the obtained values with that of our image.本测试镜像为NTFS文件系统（NTFS file system）镜像，旨在测试数据carving（data carving）工具及其提取各类文件格式的能力。该镜像包含若干已分配与已删除文件，所有文件均以连续存储格式存放在其分配空间内。所有文件均为本人持有或从零创建的随机文件。本镜像源自一块已通过取证工具FTK Imager（Forensic Toolkit FTK Imager）完成擦除与格式化的NAND型USB闪存盘，镜像文件扩展名为AD1。该镜像已移除元数据，无法被挂载，因此必须通过数据carving方法提取其中的文件。本测试镜像是NTFS文件系统的“裸”镜像（即“dd”镜像），文件系统容量为2GB。本镜像的MD5哈希值、SHA哈希值、各文件类型与文件名，以及所有其他详细信息均已在本数据集附带的.csv与.txt文件中明确列明。用户可将该镜像与任意基于数据carving的工具进行测试，并将提取得到的结果与本镜像的预设值进行交叉验证。