Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

disk imaging, hardware and software write block, forensics media preparation. In each
category, detailed test plan (NIST, 2005), specification (NIST, 2004), assertions and
support software are developed. Disk imaging and Write block are the most well-
established and documented categories and many mainstream software and hardware
are tested. For example, test result disk imaging software EnCase 6.5 (NIST, 2009),
FTK Imager (NIST, 2008) and Write block device Tableau Forensics bridge (NIST,
2007). The tests performed by the CFTT are rigorous and is also extremely difficult
for other organisations to replicate due to the amount of tasks that are required. The
number of forensic tools is also overwhelming.
Another notable effect comes from the research group SWGDE. Instead of
developing test specifications, plan, assertions like NIST, SWGDE (2009a) developed
validation testing guidelines and templates that might be helpful to the interested
parties or law enforcement agencies that undertake forensic tools validation. The
guidelines recommended by SWGDE include the test purpose, scope, methodology,
choices of test cases.
An independent researcher, Brian Carrier, has developed different test images
to validate and verify the digital forensic tools. The test images can provide help to
observing the behaviour of some key functions of the tools. Carrier (2005) described
that the purpose of these small test images is to address the needs for developing some
not too complicated and lengthy public tests. However, the numbers of test images is
very limited and they are not enough for a comprehensive review of different tools.
Byers & Shahmehri (2008a) from the Swedish National Laboratory of Forensic
Science have developed a systematic approach to evaluate the selected disk imaging
software. The evaluation process is similar to the CFTT program but not identical.
Their research has identified a set of technical variations that are the different contexts
that the tool may encounter. It links the technical variations to the testing requirements
to reveal more potential test cases for testing. The research identified several
shortcomings of the evaluation methodology of the CFTT program. The research from
Byers & Shahmehri (2009) provided deeper analysis of each test result than CFTT.
Byers & Shahmehri (2009) also pointed out that CFTT has missed the area of usability
of the tool.
27