Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

AIR passes 7 out of 15 test cases with 100% success rate and the overall success
rate is over 75%. A major problem found in AIR is that no appropriate error message
is provided to the user or logged in the image log file, whenever the program
encounters a problem. AIR does not support alternate image storage option and the
user must have a single storage device that has equal or more storage spaces than the
evidence drive (or the test drive in our case). The research has found that AIR does not
support HPA and/or DCO detection and acquisition, in contrast to the other two
evaluated tools. AIR cannot provide notification to the user when the source device
has irregular configuration. AIR also presents some usability problems. Information
such as the name of the examiner, case number and case description is not required of
the user to enter. Such information should be properly classified and carefully
documented. The information is important so it should be hoarded in a safe location
for the legal or auditing purpose. The image log file is not saved automatically after
the acquisition. A proper user manual is not provided by the AIR author due to the
immensity of time and labour demanded for preparing such a manual.
6.2 ANSWER TO THE RESEARCH QUESTIONS
The main research question for this study is to evaluate the performance of the
selected disk imaging tools during their evaluation tests. The usability of the disk
imaging tools is also one of the research areas investigated to a limited extent in this
research. According to the literature review, completeness and accuracy are the two
important metrics to measure the performance of the disk imaging tools. The research
sub-questions are related to whether the selected disk imaging tools are able to extract
accurate and complete forensic data during the tool testing. To answer the SQ1
specified in section 3.2, multiple test scenarios are designed for testing whether the
tools are extracting accurate and complete data. All the test cases are designed for
testing either the accuracy or completeness or both. For example, test cases TC-09 and
TC-10 are targeting the accuracy of the data. Test cases TC-12 and TC-13 are testing
both the accuracy and completeness of the data extracted by the disk imaging tools. To
answer the SQ2 specified in section 3.2, the disk imaging tools testing were followed a
set of forensically sound approach. The test drive is reset to a clean state at the
117