Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

5.0 INTRODUCTION
Chapter 5
Discussion of Findings
The main research question is concerned with the performance of the disk imaging
tools in terms of their accuracy and completeness. An extensive review of related
literature is conducted and presented in Chapter 2. Chapter 3 defines the research
questions and model and the tool testing methodology. According to the research
methodology, a comprehensive testing of three different tools in various test scenarios
has been completed and the findings are presented in Chapter 4. When the main
research question is defined, some sub-questions are also raised about how to measure
and what metrics should be used to test the validity of disk imaging tools.
The findings for each tested disk imaging tool are reported in Chapter 3. The
research encountered some problems and challenges in the setup of the testing
environment and configuration for different test scenarios. Chapter 3 reports the
findings from the tools testing and discusses their significance. Analysis is performed
on the findings obtained from the test environment setup and configuration for
different scenarios as well. The implications of research challenges and problems will
be further discussed and studied in section 5.1.6. Different hypotheses are proposed in
Chapter 3 to answer the main research question. The proposed hypotheses can be
tested based on the findings from the selected tools evaluation.
Chapter 5 contains two main sections: discussion of findings from the disk
imaging tools testing and evaluation of hypotheses. The discussion of evaluation
findings includes the discussion of the test environment and the performance testing
procedures. It is followed by the analysis of the results for the three tested disk
imaging tools. The present research is compared with other studies in this area and the
implications of the research challenges are also outlined. The subsequent section is a
review of how hypotheses are tested, followed by a conclusion.
96