Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

forensic tools, process or procedure are functioning as intended. IEEE (1990) is
defined Verification as “The process of evaluating a system or component to
determine whether the products of a given development phase satisfy the conditions
imposed at the start of that phase” (p. 81). Verification can be interpreted as a process
that makes sure the software tools conform to the specifications. With regard to the
digital forensic tools, Guo et al. (2009) interpreted Verification as using laboratory
tools, techniques and procedures to confirm that the software meets the specifications.
The software V&V standard provides a foundation for forensic sciences to adapt the
well-established model to its own requirements.
V&V must be tested or evaluated under a set of carefully designed requirements
and procedures. Software testing can be categorised into two groups: White box
testing and Black box testing. White box testing is appropriate if the examiner has
access to the internal structure of the software but this is unrealistic in forensics
industry. The mainstream forensic tools used by the Law enforcement or intelligence
agencies are closed source proprietary software. The source code or the internal
structure of proprietary software is maintained as trade secret to the public or to the
law enforcement. On the other hand, Black box testing evaluates the software by
comparing actual output against its expected output. The method of Black box testing
can be applied to both open source and proprietary software. In the context of digital
forensics, Black box testing is involved using the forensic tool to perform a series of
pre-defined tasks under different testing scenarios. For example, the task is to use the
forensic tool to acquire a hard disk using different hardware interfaces (USB, SATA,
IDE and Firewire). The successful outcome of the test scenario suggests that the tool
is validated for the given task under the specified conditions and environment.
However, the confidence may not be extended to the environment or condition that is
not covered in the given task.
2.2.4.2 Existing Work Of Forensic Tool V&V
CFTT is one of the programs that has dedicated much effort to evaluate the validity of
the digital forensic tools. CFTT developed testing methodologies for each function
that the digital forensic investigation may involve. The methodology of CFTT is
belongs to Black box testing. Total of seven categories have been identified, such as
26