Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

2.0 INTRODUCTION
Chapter 2
Literature Review
The rapid development of communication and computing technology has led to the
creation of large computer networks. However, this development has not come
without a corresponding growth of electronic crimes (Brungs & Jamieson, 2005, p.57).
Electronic crimes continue to pose a significant problem and cause huge financial
losses, according to the CSI/FBI survey 2007 (Richardson, 2007). Computers and
other electronic devices store many types of electronic data. Electronic data has played
a crucial role as evidence in various court cases involving corporate litigation, theft of
intellectual property, credit card fraud and pornography (Williams, 2006; Johnson,
2005). Detailed methods and procedures for evidence collection have developed
within the digital forensics in order to combat the growing number of electronic
crimes. Evidence collection is the procedure that ensures the evidence is reliable,
intact, accurate and verified (Kenneally & Brown, 2005).
Electronic evidence is fragile in nature and can easily be modified, duplicated
or damaged (Kleiman et al., 2007). Electronic evidence collected in an untested
method may not withstand scrutiny in the court of law (Williams, 2006). A
comprehensive procedure and fully tested tools must be utilised to acquire electronic
evidence. A common industry practice is to acquire a bit-stream image of the storage
media (Meyers & Rogers, 2004). Bit-stream image is the exact replica of the original
device. As distinct from the normal hard drive backup, the bit-stream image will
duplicate deleted files, file slacks, swap files, hidden areas and unallocated spaces.
Also, the accuracy of the bit-stream image must be validated as well. A mathematical
algorithm, such as MD5 or SHA1, is used to calculate a hash value for the original
disk and compute another hash value for the bit-stream image to see whether both
values are matched. Unfortunately, forensic software also has vulnerabilities like any
other kind of software. US-CERT (2007) published a note that a bug has found in
EnCase. Newsham et al. (2007) published an article to demonstrate how to break
7