This test image is a FAT12 floppy image with two files. One was created in the winter and the other in the summer. This image will test how a tool processes the times. FAT saves dates and times in a format that is not sensitive to timezones. If the tool translates the FAT time to a timezone-sensitive format, then errors could exist.
This test image is a 'raw' partition image (i.e. 'dd') of an FAT12 file system. The MD5 of the image is 9fb582f3361ba0bc5a3b0f7c17a082cb. This image is released under the GPL, so anyone can use it.
There are two files. The contents of each file contains the time that it was created. Note that the results of this test may differ depending on which season you run the test. The results may also vary if the timezone of your analysis tools are set to one that does not use daylight savings.
| Name | Created Date |
|---|---|
| winter.txt | January 1, 2004 - 2:00PM |
| summer.txt | June 1, 2004 - 3:00PM |
If the tool is not working, then it will likely show a 2 hour difference between the files. The correct time may vary depending on the time of year.
Neither Purdue University or CERIAS sponsor this work.
These tests are not a complete test suite. These were the first ones that I thought of and no formal theory was put into their design.
Passing these tests provides no guarantees about a tool. Always use additional test cases (and email them to me so we can all benefit!).
| Brian Carrier [carrier <at> digital-evidence <dot> org] | Last Updated: Jan 29, 2004 |