Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

6.1 SUMMARY OF THE RESEARCH FINDINGS
The findings of this research are pertinent to three areas: the testing environment,
evaluation procedures and the performance of each tool. The main issue related to
testing environment is the availability of tools used to configure the testing
environment. The evaluation procedure involves the utilisation of forensically sound
methods to evaluate these tools. The performance of each tool in each test case is
compared and contrasted.
The research has found that the disk configuration tools available on the
market are not adequate for conducting comprehensive evaluation tests on disk
imaging tools. The prototypes of the tools used by this research are not the tools
(Gavrila, 2005; Carrier, 2005) used in the CFTT and DFTT program. These tools have
been developed exclusively for the evaluation of digital forensic tools. It is important
to note that the tools used in this research are not special-built for digital forensic tool
testing. What the tools actually do can be uncertain. Specialised tools must be
developed to configure a proper testing environment. The limited availability of
configuration tools has posed some constraints on the types of test cases that can be
conducted for evaluating disk imaging tools. A set of forensically sound testing
procedures are constructed. The test drive is wiped with forensically proven method
before being used in a test case. Then the test drive is configured according to the test
specifications for that particular test case. Once the drive is configured, data is
acquired using the selected tools. Extra image files verification is executed again to
ensure their integrity. Finally, the test drive is wiped and any effects from the
configuration on the drive are removed to ensure that no data are left to affect the
following test cases. The research also finds that HPA or DCO hidden areas can be
overridden before the data can be acquired when these areas are connected to some of
the forensic write blockers. In the test cases that involve hidden areas, no write blocker
is used and only the visible data are hashed and verified after the data has been
acquired.
The research has found that FTK Imager has no longer the problem that existed
previously and was reported by NIST regarding version 2.5.3.14. It is also found that
the actual report of the data acquired when scanning corrupted image files is
115