Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Guo et al. (2009) have proposed a functionality driven approach for digital forensic
tools V & V. The methodology has focused on measuring the accuracy and precision
of the testing results. They identified several functional categories and also the
components of each sub-category through the method referred as function mapping
(Guo et al., 2009). Function categories have been identified, including search function
and forensic copy function (Guo & Slay, 2010). After the function mapping, V & V
requirements are specified. A typical group of reference sets that consist of different
test scenarios is then developed. After the reference sets are confirmed, the task of V
& V the defined function of digital forensic tools is conducted. Both functional
requirements and reference sets are built in an extensible way that will enable tool
testers to extend them to fulfil their special test requirements (Guo et al., 2009).
2.3 DEFINE DISK IMAGING TOOLS
A comprehensive understanding of digital forensic tools enables this research to better
define disk imaging tools. Sadui (2001) from SANS Institute defines disk imaging as
an image of the whole disk where the complete content of the disk is copied including
the location of the data. Some types of validation mechanisms are provided to prove
that the copy is exact and has not been altered. This is different from the normal
computer backup. Disk imaging creates a bit-stream of the duplicate of original data
(SWGDE, 2009). In other words, ambient or residual data such as deleted files,
unallocated spaces, and file slack will be copied as well. The reason of creating
forensic image of the original evidence is that the original evidence must be preserved
without being altered or tampered. Schweitzer (2003) also emphasises that forensic
examination needs to be conducted using only the image (copy) and not the original
hard drive. Also, according to Federal Rules of Evidence 901(a), the forensic image
copy must be authenticated and proven as same as the original copy in order to be
admissible as evidence.
28