Introduction

This test image is a FAT file system that has been modified using a hex editor. The modifications were made to determine how tools deal with images that have abnormal volume labels. I have found that the consistency checking under Windows XP allows several scenarios that, according to the FAT specification, should not be allowed. This test image has some of those illegal situations and contains hidden data.

Download

This test image is a 'raw' partition image (i.e. 'dd') of a FAT file system. The file system is 10MB and is compressed to 120 KB. The MD5 of the image is aa834dca822918de45792f4e115516b9. This image is released under the GPL, so anyone can use it.

• zip

Environment

This section will describe what changes were made to the image. This form can be used to test your tool with these changes.

• The volume label in the boot sector is "LABEL1"
• The directory entry in the root directory with the volume label attribute set is named "LABEL2". Its MD5 value is 8071eeaa52cd372a9bbb093e348e605c.
• The directory entry in the dir1 directory with the volume label attribute set is named "FILE2.DLL". Its MD5 value is 8aeca328aa6fbb7d2ec01f8c2f3e4bbd.
• Both of the directory entries with the volume label attribute set have clusters allocated to them. One is random data with the string "over here" and the other is a JPEG.
• The check disk in Windows XP was run on the file system before acquisition and no errors were found

Author

Disclaimers

These tests are not a complete test suite. These were some of the first ones that I thought of and little formal theory was put into their design.

Passing these tests provides no guarantees about a tool. Always use additional test cases (and email them to me so we can all benefit!).

Copyright © 2004 by Brian Carrier Email: carrier <at> digital-evidence <dot> org

Last Updated: August 22, 2004