Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Software support is minimum and the support is provided by submitting help to the
Source Forge discussion board or sending email to the author directly.
5.1.5 Comparison With Other Related Studies
A Function Map (see Figure 3.12) was created to assist this research to identify the
essential and potential components for testing the disk imaging tools. With more
potential components identified, the specification of the testing requirements could
become more comprehensive. Guo& Slay (2010) state that Function Mapping
provides the level of abstraction that could provide tool testers or forensic software
developers with a comprehensive representation of the functions required for the tool.
Sections 3.1.1 and 3.1.2 in Chapter 3 review two previous studies that provided
this study with valuable information about how to extensively test disk imaging tools.
CFTT program has specified mandatory testing requirements that are taken into
account in this research. Some of the optional requirements specified in CFTT
program are omitted. Clone creation and Block hashing are excluded from the scope of
this research due to the fact that these functions are not available in the disk imaging
tools chosen in the present research. Following the review of another research in
Section 3.1.2, a section called Hidden Sector is added to the requirements that are
considered as an important component of the disk imaging tools testing. The test
assertions derived from the requirements for Hidden Sector section are based on the
research reviewed in Section 3.1.2 (see Appendix 1 and 3). CFTT specification and
assertions are only concerned with the information being accurately logged in the log
file but do not specify what log information is essential for the forensic investigation.
It has not been measured whether the information displayed by the tool is the same as
the information recorded in the log file. Therefore, requirements and correspondent
assertions of TSP-RLOG-02 and TSP-RLOG-03 have been added to the research.
In both CFTT (NIST, 2005) and Byers & Shahmehri (2009) studies, GPT
partitioning scheme is not included but the popularity of the scheme has been
increasing exponentially as indicated in Section 2.3.4. Test cases TC-16 and TC-17
that involve GPT partitions are added. The file systems HFS and HFS+ are also added
to the testing requirements. GPT partition and HFS, HFS+ file systems are commonly
106