Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

5.1 DISCUSSION OF THE FINDINGS FROM TOOLS TESTING
This section discusses the findings from the testing of three disk imaging tools in the
present research. The section first discusses the settings, configurations and problems
of the testing environment and then describes the tool testing procedures. The findings
for each tested disk imaging tool are discussed and reviewed in separate sections,
followed by the discussion of the research challenges and how the research differs
from other related studies.
As a result of the review of some previous studies in this domain, a group of
programs were selected and adopted as configuration tools to create an appropriate
testing environment for testing the disk imaging tools. The selected configuration tools
were the best possible tools that were available in the research. However, most of the
configuration tools were not meant to be used for the purpose of configuring
environments for digital forensic software testing. Programs such as MHDD and
HDAT2 have been designed to test or to diagnose storage devices. These tools were
utilised as hard drive manipulation tools to configure a proper testing environment.
Both MHDD and Hdat2 were used to configure Hidden areas HPA. However, when
Hdat2 was utilised to create HPA, the HPA could not be recognised by MHDD and
vice versa. The reason was unknown and the developer has been informed of the
problem. Unfortunately, the developer could not determine the exact cause for this
problem. Hex editor UltraEdit was used as a verification tool to ensure that the disk
imaging tools had replaced the inaccessible data with a specified value. EnCase was
also used as a verification tool to verify the hash values of the image files acquired by
the disk imaging tools that were subjected to test.
Both CFTT programs from NIST and research from Byers & Shahmehri
(2009) have developed their own configuration tools to meet the requirements of their
tool testing. However, the tools developed by other researchers could not fully meet
the requirements of this research. Resources were also limited for the development of
customised configuration and verification tools that could fully fulfil the research
requirements. The type and number of tests that could be ran on the tested tools were
constrained by the availability and functionality of the configuration and verification
97