Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Table 5.2
Hypotheses Testing
Hypotheses
H1: FTK Imager will perform
better than or equals to the
other selected disk imaging
tool in most of the common
test cases.
H2: Helix 3 Pro will perform
better than or equals to AIR
Imager in most of the
common test cases.
H3: AIR will perform better
than the other two selected
disk imaging tools in very few
test cases
In Favour
(Evidence)
Perform better than
others:
TC-07,TC-08
Perform equals to:
TC-01 to TC-03, TC05 to
TC08, TC-12(1), TC-13 to
TC-14, TC-16, TC-17
111
Against
(Evidence)
TC-01 to TC-06, TC-
08, TC-12 to TC-18
Perform better than
others:
TC-12(2), TC-15,TC-
18
Perform equals to:
TC-01 to TC-06, TC-
12(1), TC-13 to TC-
14, TC-16 to TC-17
Hypothesis H2 is not supported. Helix 3 Pro performed worse than AIR in most of the
common test cases. In test case TC-12 where the tool required acquiring hidden
partitions, Helix 3 Pro was not able to complete the entire imaging process. Helix 3
Pro only achieved 28.57% passed rate whereas AIR achieved 78.95%. Hence, Helix 3
Pro failed to provide complete information to the user. The incomplete information
will lead to the inability of forensic investigator to gain full knowledge of the acquired
data. In test case TC-16 where the tool required acquiring a GPT disk, Helix 3 Pro
was not able to recognise the partition table. However, AIR acquired the GPT disk
successfully and extracted accurate and complete image files. Apart from the two
prominent test cases mentioned above, AIR also outperformed Helix 3 Pro in other
common test cases. This hypothesis is not in line with author‟s speculation.
Hypothesis H3 is not supported. AIR was the best performer among the tested
tools. AIR has achieved overall pass rate 90.81% whereas FTK Imager and Helix 3
Pro have achieved 88.73% and 73.62%, respectively. In test cases TC-12(2), TC-15