GUYMAGER ACQUISITION INFO FILE ============================== Guymager ======== Version : 0.8.11-1 Version timestamp : 2019-06-26-09.00.00 UTC Compiled with : gcc 6.3.0 20170516 libewf version : 20140608 (not used as Guymager is configured to use its own EWF module) libguytools version: 2.1.0 Host name : caine Domain name : (none) System : Linux caine 5.0.0-32-generic #34~18.04.2-Ubuntu SMP Thu Oct 10 10:36:02 UTC 2019 x86_64 Device information ================== Command executed: bash -c "search="`basename /dev/sda`: H..t P.......d A..a de.....d" && dmesg | grep -A3 "$search" || echo "No kernel HPA messages for /dev/sda"" Information returned: ---------------------------------------------------------------------------------------------------- No kernel HPA messages for /dev/sda Command executed: bash -c "smartctl -s on /dev/sda ; smartctl -a /dev/sda" Information returned: ---------------------------------------------------------------------------------------------------- smartctl 6.6 2016-05-31 r4324 [x86_64-linux-5.0.0-32-generic] (local build) Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org SMART support is: Unavailable - device lacks SMART capability. A mandatory SMART command failed: exiting. To continue, add one or more '-T permissive' options. smartctl 6.6 2016-05-31 r4324 [x86_64-linux-5.0.0-32-generic] (local build) Copyright (C) 2002-16, Bruce Allen, Christian Franke, www.smartmontools.org === START OF INFORMATION SECTION === Device Model: VBOX HARDDISK Serial Number: VB90dbf5a1-ed54a068 Firmware Version: 1.0 User Capacity: 10.737.418.240 bytes [10,7 GB] Sector Size: 512 bytes logical/physical Device is: Not in smartctl database [for details use: -P showall] ATA Version is: ATA/ATAPI-6 published, ANSI INCITS 361-2002 Local Time is: Fri Feb 17 10:29:56 2023 CET SMART support is: Unavailable - device lacks SMART capability. A mandatory SMART command failed: exiting. To continue, add one or more '-T permissive' options. Command executed: bash -c "hdparm -I /dev/sda" Information returned: ---------------------------------------------------------------------------------------------------- /dev/sda: ATA device, with non-removable media Model Number: VBOX HARDDISK Serial Number: VB90dbf5a1-ed54a068 Firmware Revision: 1.0 Standards: Used: ATA/ATAPI-6 published, ANSI INCITS 361-2002 Supported: 6 5 4 Configuration: Logical max current cylinders 16383 16383 heads 16 16 sectors/track 63 63 -- CHS current addressable sectors: 16514064 LBA user addressable sectors: 20971520 LBA48 user addressable sectors: 20971520 Logical/Physical Sector size: 512 bytes device size with M = 1024*1024: 10240 MBytes device size with M = 1000*1000: 10737 MBytes (10 GB) cache/buffer size = 256 KBytes (type=DualPortCache) Capabilities: LBA, IORDY(cannot be disabled) Queue depth: 32 Standby timer values: spec'd by Vendor, no device specific minimum R/W multiple sector transfer: Max = 128 Current = 128 DMA: mdma0 mdma1 mdma2 udma0 udma1 udma2 udma3 udma4 udma5 *udma6 Cycle time: min=120ns recommended=120ns PIO: pio0 pio1 pio2 pio3 pio4 Cycle time: no flow control=120ns IORDY flow control=120ns Commands/features: Enabled Supported: * Power Management feature set * Write cache * Look-ahead * 48-bit Address feature set * Mandatory FLUSH_CACHE * FLUSH_CACHE_EXT * Gen2 signaling speed (3.0Gb/s) * Native Command Queueing (NCQ) Checksum: correct Hidden areas: unknown Acquisition =========== Linux device : /dev/sda Device size : 10737418240 (10,7GB) Format : Expert Witness Format, sub-format Guymager - file extension is .Exx Image meta data Case number : 01 Evidence number : Examiner : Description : Notes : VB90dbf5a1-ed54a068 Image path and file name: /mnt/imagenUbuntuServer.Exx Info path and file name: /mnt/imagenUbuntuServer.info Hash calculation : MD5 Source verification : off Image verification : on No bad sectors encountered during acquisition. State: Finished successfully MD5 hash : c0454089d4cd89b54bbc774dd4f648c6 MD5 hash verified source : -- MD5 hash verified image : c0454089d4cd89b54bbc774dd4f648c6 SHA1 hash : -- SHA1 hash verified source : -- SHA1 hash verified image : -- SHA256 hash : -- SHA256 hash verified source: -- SHA256 hash verified image : -- Image verification OK. The image contains exactly the data that was written. Acquisition started : 2023-02-17 10:29:46 (ISO format YYYY-MM-DD HH:MM:SS) Verification started: 2023-02-17 10:32:43 Ended : 2023-02-17 10:33:22 (0 hours, 3 minutes and 36 seconds) Acquisition speed : 57.85 MByte/s (0 hours, 2 minutes and 57 seconds) Verification speed : 262.56 MByte/s (0 hours, 0 minutes and 39 seconds) Generated image files and their MD5 hashes ========================================== No MD5 hashes available (configuration parameter CalcImageFileMD5 is off) MD5 Image file n/a imagenUbuntuServer.E01