NTFS Undelete (and leap year) Test #1

Digital Forensics Tool Testing Image (#7)



This test image is a 6MB NTFS file system with eight deleted files, two deleted directories, and a deleted alternate data stream. The files range from resident files, single cluster files, and multiple fragments. No data structures were modified in this process to thwart recovery. They were created in Windows XP, deleted in XP, and imaged in Linux.


This test image is a 'raw' partition image (i.e. 'dd') of a NTFS file system. The file system is 6MB and is compressed to 186 KB (lots of zeros). The MD5 of the image is e7dbb96759d9cd62b729463ebfe61dab. This image is released under the GPL, so anyone can use it.


These are the files that should be recovered, their sizes, and their MD5 values. (Fill in the blank results form)

NumMFT EntryNameSizeMD5Note
137\res1.dat1019036637712b491904cd0bfbdbe648453Resident file (data is stored in MFT entry and not in a cluster)
231\sing1.dat78059b20779f69ff9f0ac5fcd2c38835a79single cluster file
332-128-3\mult1.dat3801ffd27bd782bdce67750b6b9ee069d2efmultiple cluster, non-fragmented file
432-128-6\mult1.dat:ADS1234ba1b9eedb1c091ddca253d35dde8f616multiple cluster, second data attribute (Alternate Data Stream)
529\frag1.dat15847a3bc5b763bef201202108f4ba128149fragmented file
630\frag2.dat38730e80ab84ef0087e60dfc67b88a1cf13efragmented file with frag1.dat mixed in
836\dir1\mult2.dat171559cf0e9cd107bc1e75afb7374f6e05bbmultiple cluster, non-fragmented in deleted directory
934\dir1\dir2\1024N/Adirectory in deleted directory
1035\dir1\dir2\frag3.dat202721121699487f3fbbdb9a4b3391b6d3e0fragmented file in deleted directories
1138\dir3\sing2.dat1005c229626f6a71b167ad7e50c4f2fccdb1single cluster file in a directory whose MFT entry has been reallocated (to res1.dat)


Here is the actual layout of the image.

4073\frag1.dat (part 1 of 2)
4074\frag2.dat (part 1 of 3)
4075\frag1.dat (part 2 of 2)
4076-4077\frag2.dat (part 2 of 3)
4085\frag2.dat (part 3 of 3)
4086-4089\$Secure:$SDH (Not deleted)
4090\dir1\dir2\frag3.dat (part 1 of 2)
4093\dir1\dir2\frag3.dat (part 2 of 2)


This image was created on Feb 29, 2004 so check the dates in your tools to see if your tool properly handles leap year.


Brian Carrier (carrier <at> digital-evidence <dot> org) created the test cases and the test image. This test was released on February 29, 2004.


Neither Purdue University or CERIAS sponsor this work.

These tests are not a complete test suite. These were the first ones that I thought of and no formal theory was put into their design.

Passing these tests provides no guarantees about a tool. Always use additional test cases (and email them to me so we can all benefit!).

SourceForge Logo

Brian Carrier [carrier <at> digital-evidence <dot> org] Last Updated: Mar 24, 2004