Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

The aim of this chapter is to provide an overview of the research findings and the
structure of the thesis. The rationales behind this research are explained from the legal
and technology perspectives in Section 1.1. The main research findings are discussed
briefly and presented in Section 1.2. The structure of the thesis is presented in Section
1.3.
1.1 MOTIVATION OF THE RESEARCH
Digital forensics has been well developed in the past decade and has become an
important component of many investigations. Investigators from both private and
public sectors are relying on the digital forensic tools on a daily basis to gather, assess
and analyse digital evidence.
Garfinkel (2010) states that digital forensics is facing a crisis and the tool has
gradually become obsolete. The digital forensics community is facing intimate
challenges, especially in the process of data collection (Mohay, 2005; Mercuri, 2005).
From a legal perspective, according to the guidelines established in Daubert Standard
(Daubert v. Merrell Dow Pharmaceuticals, Inc., 1993), scientific evidence that is
admissible to the court must be validated by five relevant factors. The five relevant
factors will be described in Section 2.2.2. The techniques and methods that are used
for the collection, analysis and presentation of the digital evidence can be challenged
by lawyers as they become more familiar with the technology adopted. However, the
progress of the validation of such techniques and methods is limited. The admissibility
of the digital evidence can be guaranteed if underlying techniques or methods are
scientifically validated and recognised (Erbacher, 2010). Guo et al. (2009, p.S12) also
pointed out that one of the challenges the digital forensics practitioners are facing is
the difficulty of assuring that the digital evidence extracted by the digital forensic tools
is reliable.
There are also technical constraints for digital forensics that are presented and
operated in a dynamic computing environment. Forensics practitioners are required to
process enormous volumes of data. This task is so demanding that investigators are
struggling to transform those data into investigative knowledge. Using a single tool or
a forensics toolkit, such as EnCase or FTK, to fulfil all the requirements in different
2