Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

seen in Apple computers. The number of Apple computers in the market has been
increasing exponentially over the past few years. In October 2010, Apple revealed that
3.89 million Macs were sold in the previous quarter (Oliver, 2010, p.1). The number
of investigations that involve Apple computers has been expected to increase. Adding
such file systems and partition types is a logical choice for the evaluation to expand
the testing range and types. Research reviewed in Section 3.1.2 suggests that usability
of the disk imaging tools is the area that CFTT program has not addressed. Poor
usability of the tools may lead the user to the mistaken action that could possibly
affect the acquisition process. For instance, a poorly structured user interface may lead
the user to choose wrong acquisition options and may affect the quality of the
acquisition. This motivates this research to include usability-related observations in
the research discussion.
5.1.6 Research Challenges
A number of technical problems were encountered during the process of tool testing.
One of the challenges arose from the tool used to configure the test drive for testing.
Hidden areas caused problems because they were automatically removed when
booting into the Linux environment. The only write blocker available in the forensics
laboratory was from Tableau but the product of this brand would automatically
override the test drive if the hidden areas were present. Some of the challenges were
posed by the use of Linux Forensics Live CDs during the testing as well.
5.1.6.1 Configuration Tools
One of the challenges of the research is to locate the right tools for the designed test
cases. The evaluation requires the researcher to perform low-level manipulation over
the test drives. The tools that are available to the researcher and able to meet the
researching requirements are limited. As mentioned in section 4.2.1, the tools that are
available for the research are not specifically designed for forensic software testing.
The tool sets developed by NIST are the only specialised forensic software validation
tools that are publicly available. In section 2.2.4, forensics software testing and/or
validation are discussed as one of the challenges for the industry and the adoption of
such tools to support the validation is technically demanding. As reviewed in section
107