Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

eginning of and the end of the disk imaging to ensure that no data from previous use
is still remained. The mechanism used to reset the test drive is developed by
Department of the Defense of America. Tableau Write Blocker is utilised consistently
(where applied) to ensure no accidentally write attempt to the test drive. Every result is
also verified again using EnCase to ensure the extracted data are identical to the source.
To answer the SQ3 specified in section 3.2, this study has developed a way to rank the
disk imaging tools according to their performance. Each disk imaging tool is
undergoes a series of test cases and each test case composes a set of assertions. The
assertions will be tested and marked either pass or fail. The pass rate is calculated by
using the total number passed assertions to divide the total number of assertions in the
test case. The tools are then ranked according to their overall pass rate in all test cases.
Section 5.2 describes and discusses the results of the hypotheses testing. To
answer the main research question, the testing results indicate that AIR performed
better than or equal to the other two disk imaging tools in most of the common test
cases. Helix 3 Pro performed worse than other two disk imaging tools and Helix 3 Pro
also presented many problems. It is recommended that the disk imaging tools must be
fully validated and verified as extensively as possible. The tool testing must be
conducted in different configurations and different execution environments.
6.3 AREAS OF FUTURE RESEARCH
Current digital forensic tools are unable to keep pace with the growing complexity and
rapid evolution of technology in the contemporary digital environment (Roussev &
Richard, 2004; Ayers, 2009). Building a systematic and scientifically proven
methodology to validate the functions of the digital forensics tool is a demanding job.
What has been achieved by CFTT, DFTT and other researchers can be used as
stepping stone to building a comprehensive testing framework. The framework must
be automated, tool-independent and future-proof. Disk imaging is an important
constituent of the evidence collection in the digital forensics investigative process,
according to DFRWS investigative process described in section 2.1.2. Activities such
as examination, analysis and presentation are also crucial for the digital forensics
investigation. Different test scenarios with different hardware types can be imposed on
118