Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

13
Investigative Process Model
(Freiling & Schwittay, 2007)
2.1.3 Development And Evolution of Digital Forensic Tools
14
4 phases 1-5
It was common to use the evidentiary computer to gather evidence when no
specialised digital forensics tools were available. The major risk of this traditional
approach is that potential evidence can be overlooked such as deleted and hidden files.
In addition, the integrity of the evidence is not verifiable. Software programs, such as
DD (shown in Table 2.2), could be used to acquire the content of an entire hard disk
and even capture the deleted data but these programs are not widely recognised as a
forensic tool. It was adopted in the law enforcement sector but most of the forensic
investigators were still performing investigations at file system level without showing
much heed to deleted and hidden data. Several software programs are discussed
through this section to analyse the development and evolution of the digital forensic
tools. The analysis will help the research better understand the capability of the digital
forensic tools. Table 2.2 summarises the main functionalities of the discussed software
programs in this section.
Software programs that are capable of recognising different file types and
recovering deleted files have appeared in the market such as Norton DiskEdit and
XtreeGold (shown in Table 2.2). Some specialised forensic tools, such as SafeBack
and DIBS (shown in Table 2.2), were developed with the capability of collecting
electronic evidences without damaging the integrity of the original evidentiary data.
The Law enforcement sector such as Royal Canadian Mounted Police (RCMP) also
developed their specialised software tools for computer investigations (Casey, 2004).
The introduction of large data storage devices caused new problems for forensic
investigators (Akhter, 2008). Automated and integrated software toolkits such as,
EnCase, FTK and iLook (shown in Table 2.2), were developed to help forensic
investigators process digital evidence more efficiently and effectively and also
overcome challenges such as large hard drives and evidence searching. The toolkits
usually feature a user-friendly and clear graphical user interface (GUI) to assist the
user locate potential evidence much promptly. Searching and indexing are optimised