Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

circumstances is unrealistic. Also, even the most popular tools can have flaws that
cannot be discovered easily. Ayers (2009a) discovered flaws in EnCase when the dates
and time values were handled and the problems were confirmed by the developer
Guidance Software. Ayers (2009) also commented that the ability to gain insight into
how the commercial tools are operating is very limited. Sometimes, open-source
software may be required when the commercial tools fail to fulfil the tasks in certain
parts of the investigation. Despite the fact that some types of the open-source software
are well built and well documented, some of the tools are out-of-date and poorly
documented. There is no doubt that forensic tools with varied quality and
documentation must be validated and verified thoroughly. Comprehensive forensic
tool validation is an important research topic suggested by many researchers (Peterson,
Shenoi, & Beebe, 2009; Garfinkel, 2010; Ayers, 2009).
1.2 RESEARCH FINDINGS
The research has summarised some findings pertinent to different aspects of forensic
tool performance testing. In terms of the testing environment, Windows and Linux
platforms were chosen as the target validation environment. In order to evaluate the
disk imaging tools extensively, the research is required to develop customised disk
configuration tools to fulfil the requirements if the resources are allowed. The testers
may not be able to comprehend fully knowledge of how the tools operate when using
configuration tools that are developed by third-party developers. Details of the test
environment setup and testing procedure are presented in Sections 4.2.1 and 5.1.1.
A disk imaging tools testing procedure has been adopted from NIST and
redefined to suit the research. Before the start of every new test case, the test drive
must be reset or wiped with some proven mechanisms. The test drive can be
configured using various methods according to the test specifications. Hardware or
tested software write blocker must be used consistently to prevent any alterations to
the test drive. Hardware write blocker was not used in some pre-specified test cases.
The reason why the hardware write blocker was not used is discussed in Section
5.1.7.3. Disk imaging tools must be operated according to the user manual to avoid
3