Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

The method of data analysis is described in section 3.4.3. GA is selected as the method
to analyse the data in this research project. According to Table 4.20, The GA matrix
can be constructed based on Table 4.20 (see Appendix 6). The Gap of each evaluated
tool can be identified as:
Gap = Required Requirements – Actual performance of the Tool
There are few major gaps between three tested tools. None of the three tested tools
was able to acquire the disk image in test cases TC-03, TC-12 and TC-17 that involved
HPA or DCO configuration. Furthermore, none of the tested tools were able to detect
and report to the user the irregularities configured in test cases TC-13 to TC-15
according to the test assertion TSP-AIC-11.
According to the results presented in figure 4.1, FTK Imager achieved the
expected test result in more than half of the test cases that were applied. FTK Imager
presented problems in areas where hidden areas are existed and where the source drive
had irregular configuration. Helix 3 Pro did not achieve the expected result in most of
the test cases.
The testing requirements for this research specified that each tested tool was
required to provide essential information (such as start and end sectors) to the user in
the log file. In the log file of Helix 3 Pro, start and end sectors were not provided as
standard output in the log file. Therefore, Helix 3 Pro was marked as failed on the test
assertion ALOG-02 in each test case. Some popular file systems and partition table
formats, such as HFS, HFS+ and GUID partition table are not supported by Helix 3
Pro. On the other hand, FTK Imager and AIR successfully identified and acquired the
file system types and partition table that were not supported by Helix 3 Pro. AIR also
presented few problems during the evaluation. Whenever there was a problem, AIR
would stop the acquisition process immediately and no information as to why the
process had stopped would be provided to the user. For example, when the destination
device did not have enough storage space to store the image files, AIR program would
stop immediately and would not provide information to the user why the process
terminated.
88