FAT Volume Label Test #1

Digital Forensics Tool Testing Image (#9)



This test image is a FAT file system that has been modified using a hex editor. The modifications were made to determine how tools deal with images that have abnormal volume labels. I have found that the consistency checking under Windows XP allows several scenarios that, according to the FAT specification, should not be allowed. This test image has some of those illegal situations and contains hidden data.


This test image is a 'raw' partition image (i.e. 'dd') of a FAT file system. The file system is 10MB and is compressed to 120 KB. The MD5 of the image is aa834dca822918de45792f4e115516b9. This image is released under the GPL, so anyone can use it.


This section will describe what changes were made to the image. This form can be used to test your tool with these changes.


Brian Carrier (carrier <at> digital-evidence <dot> org) created the test cases and the test image. This test was released on August 22, 2004.


These tests are not a complete test suite. These were some of the first ones that I thought of and little formal theory was put into their design.

Passing these tests provides no guarantees about a tool. Always use additional test cases (and email them to me so we can all benefit!).

Copyright © 2004 by Brian Carrier
Email: carrier <at> digital-evidence <dot> org
SourceForge Logo Last Updated: August 22, 2004