Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

for fast searching of evidence from large amounts of data. EnCase and FTK are now
becoming forensic proven software tools and commonly used in private and public
sector for digital forensics investigation. A number of outstanding Linux and Unix
based forensic tools with user friendly GUI have been developed, such as Sleuthkit,
SMART and Helix (shown in Table 2.2). Farmer and Venema (1999) created a
software toolkit called The Coroner‟s Toolkit (TCT) to respond to the lack of forensic
software in UNIX platform. TCT (shown in Table 2.2) is capable of analysing all the
activities in a live system and capturing all the current state information of the
platform. However, this toolkit was not designed to produce court admissible evidence
but to determine what happened on a compromised machine. A debate has arisen to
discuss whether open source digital forensic tools can be used for digital forensic
investigation. Kenneally (2001) and Carrier (2002) have published their articles to
support the debate.
The popularity of the Internet has grown exponentially and crimes involving
the Internet also have been increasing dramatically. The term network forensics has
emerged. Cohen & Schroader (2007, p.172) define network forensics as the sniffing,
recording, and analysis of network traffic and events. Progress has been made in
innovation of network forensic tools. Sitaraman & Venkatesan (2006) maintain that
several tools such as Snort, TcpDump, Pcap and NetAnalysis (shown in Table 2.2) can
perform network forensic activities. Some commercial tools such as NetIntercept,
SilentRunnder (shown in Table 2.2) provide integrated search, visualisation and
comprehensive analysis features for forensic investigators to retrieve evidence from
network traffic (Casey, 2004). Different forms of evidence in a networking
environment post a challenge for digital forensics investigators because a single tool
may not be able to support all types of evidence. Usually a combination of tools and
excellent individual skills are required to extract and analyse different types of
information.
Table 2.2 provides a list of products including software and hardware that are
reviewed in Chapter 2. The purpose of the Table 2.2 is to make a ready comparison
between different digital forensic tools. The digital forensic tools are listed and
comparative data are provided to guide the research focus. Table 2.2 also helps the
15