Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

producing unreliable results. Extra verification should be conducted over the acquired
data with the application of another well-tested tool.
Three disk imaging tools were tested against different test scenarios. The performance
of each evaluated tool varies. AIR has achieved higher overall pass rate than the
others, followed by FTK Imager. Helix 3 Pro has not achieved 100% pass rate in any
test cases (see Section 5.1.3 for more details). During the acquisition of HPA or DCO
hidden areas, none of the evaluated disk imaging tools was able to acquire the hidden
areas (see testing results in Sections 4.2.2.3 and 4.2.2.10). Helix 3 Pro has presented
problems in some test cases. Some usability problems were observed and discussed as
well. Better usability will improve the user experience of the software. The disk
imaging tool AIR also presented a few problems both in terms of usability and
performance (see discussion in Section 5.1.4). The research encountered technical
challenges such as locating configuration tools, dealing with hidden areas and using
Forensics Live CDs during the evaluation (further details are provided in Section
5.1.6).
1.3 STRUCTURE OF THE THESIS
The thesis consists of four main sections apart from Chapter 1. Introduction and
Chapter 6. Conclusion. Chapter 1 sheds light on the gaps in the research areas and the
motivation of this research.
Chapter 2 presents a literature review and studies the findings of other academic
studies in this research field. The state-of-the-art of digital forensics is reviewed at the
beginning of the chapter. The review of investigative processes & standardisations can
help the researcher to understand the standard disk imaging procedures that are used in the
industry. The research reviews the evolution of digital forensics tools and the
characteristics of existing tools in the market (including their limitations). The chapter
then investigates the legal and technical implications of digital forensics tools. It reviews
the definition and characteristics of digital evidence and how it can be recognised as
admissible in courtroom. Most of the digital evidence is collected, analysed and presented
using digital forensic tools. The validity of the digital evidence extracted by the digital
forensic tools may be challenged. Forensic practitioners are demanding research on the
validation of digital forensics tools. The background and the existing works on digital
4