Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

List of Figures
Figure 2.1: DFRWS Investigation Process ....................................................................... 11
Figure 2.2: NIJ Investigation Process ............................................................................... 12
Figure 3.1: Methodology of Disk Imaging Tools Evaluation from NIST ........................ 45
Figure 3.2: Methodology of Disk Imaging Tools Evaluation Byers & Shahmehri .......... 47
Figure 3.3: Forensic Computing Software Evaluation Process Wilsdon & Slay ............. 48
Figure 3.4: Process of OTSO Method............................................................................... 51
Figure 3.5: Process of Evaluation Criteria Definition ...................................................... 52
Figure 3.6: Process of Function Oriented Paradigm Guo & Slay ..................................... 54
Figure 3.7: Research Model .............................................................................................. 56
Figure 3.8: Research Phases ............................................................................................. 58
Figure 3.9: Function Map ................................................................................................. 61
Figure 3.10: Example of Gap Analysis ............................................................................. 64
Figure 3.11: Data Map ...................................................................................................... 68
Figure 4.1: Summary of FTK Imager Evaluation Result .................................................. 92
Figure 4.2: Summary of Helix 3 Pro Evaluation Result ................................................... 93
Figure 4.3: Summary of AIR Evaluation Result ............................................................... 94
Figure 4.4: Summary of Three Evaluated Tools ............................................................... 95
xii