Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

2.1.2 Investigative Processes And Standardisations
The procedures for conducting digital forensics investigations are neither consistent
nor standardised, but rather the result of disciplined professional practice (e. g. In
Police laboratories) or the result of investigators adopting the many guidelines for best
practice that come from various police sources. The procedures and the need for
standardisation for digital forensics investigation are evolving continuously. The
processes or approaches used for digital investigations are largely adopted from other
investigation related discipline areas. If any steps of the process have been neglected
or cannot be validated, it may lead to an incomplete or inconclusive result or findings
(Baryamureeba & Tushabe, 2004). Investigation processes or procedures are driven by
the technology and tools utilised in the investigation. If the technology or tools used in
the investigation change, the associated procedures or processes have to adapt
correspondingly. Many research groups such as the Computer Analysis and Response
Team (CART), the Scientific Working Group on Digital Evidence (SWGDE), the
Technical Working Group on Digital Evidence (TWGDE), and the National Institute
of Justice (NIJ) have been dedicating their efforts to the creation of a standardised
approach for digital forensics investigations (Noblett et al., 2000). Studying the
investigative processes and standards will assure the tool validation follows
procedures that are scientifically proven and recognised by the industry.
DFRWS, a research consortium lead by a group of academics, is a significant
participant in the development of digital forensic investigative processes. DFRWS
considers one of the biggest challenges in computer forensic science is that “analytical
procedures and protocols are not standardized nor do practitioners and researchers use
standard terminology” (Palmer, 2001, p.7). Therefore, DFRWS has worked to
develop a generic digital forensics investigation process that includes such phases as
“identification, preservation, collection, examination, analysis, presentation, and
decision” (Palmer, 2001). This process depicted in Figure 2.1 lays down an important
foundation for the future work on digital forensics standardisation. Another
commendable effort in digital forensics standardisation was made by National Institute
of Justice (NIJ) of the United States.
10