Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Preparation Collection Examination Analysis Reporting
Figure 2.2. NIJ Investigation Process
Many academics, research groups and corporations have attempted to develop
frameworks for digital forensics investigations including the examples presented in
Table 2.1. Selamat, Yusof, & Sahib (2008) summarised that the existing digital
forensics frameworks (see Table 2.1) can map onto five common phases, namely
Phase1 - Preparation, Phase 2- Collection and Preservation, Phase 3 - Examination and
Analysis, Phase 4 - Presentation and Reporting and Phase 5 - Disseminating the case.
Table 2.1 summarises different digital forensic investigation frameworks so that
standard digital forensics investigation procedures can be established. Different
activities and processes are also incorporated into appropriate phases. This study not
only summarised some previous frameworks in great detail but also simplifies the
existing frameworks. According to the result analysis from Selamat et al. (2008), most
of the existing frameworks include the critical phases phase 2, 3 and 4. On the other
hand, many frameworks (Pollitt, 1995; Stephenson, 2003) do not include phase 1 and
5 as their standard processes. However, some frameworks (Baryamureeba & Tushabe,
2004; Beebe & Clark, 2004; Carrier & Spafford, 2003; Ciardhuain, 2004; Freiling &
Schwittay, 2007; Rogers, Goldman, Mislan, Wedge, & Debrota, 2006; Kohn, Eloff, &
Olivier, 2006; Reith, Carr & Gunsch, 2002) suggest that Phase 1 and 5 are significant
to ensure the completeness of digital forensic investigations to produce accurate and
conclusive results.
Some of the frameworks have similar approaches on how to perform an
investigation. For example, Carrier & Spafford (2004) and Kent, Chevalier, Grance, &
Dang (2006) have similar approaches on acquiring digital evidence specifically in hard
disk imaging. It consists of two parts, namely disk imaging and forensic copy
verification. A complete forensic disk image backup is required and the original
evidence is preserved as physical evidence. After the forensic copy is made, its
integrity is verified. Tools can be employed to compute the message digest of the
original to the forensic copy, then compare the two values and make sure they are
12