Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

and TC-18, AIR has outperformed other two disk imaging tools. AIR was able to
provide accurate and complete result in those test cases. The accuracy of the result is
essential for disk imaging tools. Lawyers can challenge the validity of the disk
imaging tools and dismiss the relevant evidence if the forensic investigator performed
data acquisition by using an improperly validated tool. This hypothesis is not in line
with author‟s speculation.
5.3 CONCLUSION
This Chapter discusses the findings based on the data collected from the evaluation of
the disk imaging tools. Testing environment and procedures are discussed as two
important elements of the disk imaging tools validation. These two elements have a
direct impact on the quality and accuracy of the evaluation result. The significance of
the test cases is discussed for each individual tool. The focus of the discussion of each
tool is on the failed test cases. The analysis of possible reasons why the tool failed in
the particular test cases provides key findings.
Research challenges are discussed with regards to various problem areas. The
availability of the configuration tools for the testing environment was limited and it
restricted the ability to run different types of test cases for the research. Wider range
and types of test cases could improve the accuracy and completeness of the research.
The discussion of the challenges posed by using the Linux Forensics Live CDs can
alert other researchers if they intend to conduct similar type of research.
The findings of the tools testing imply that the testing requirements,
configuration and the performance of the disk imaging tools are closely linked. The
research found the performance of the disk imaging tools are vary from case to case.
Hypotheses 2 and 3 are not in line with the author‟s original speculation. AIR is
outperformed than other two disk imaging tools and Helix 3 Pro performed the worst
among three tools. The author was speculating that Helix 3 pro would perform better
because of its reputation and the rich functionalities provided. Apart from the research
model depicted in Figure 3.7, the research also investigate the usability of the tools.
Problems concerning the usability of the tools are discussed in sections from 5.1.3 to
5.1.5.
112