Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

2.3.1 Attributes Of Disk Imaging Tools
NIST (2005) suggests that two critical measurable attributes of the disk imaging
process are accuracy and completeness. NIST (2005) further defines accuracy as a
qualitative measure to verify whether each bit of data of the forensic copy is matched
to the corresponding bit of the source. Completeness is a quantitative measure to
verify whether every bit of source data is imaged (NIST, 2005).
There are several factors that affect the two attributes outlined above. In order
to access the evidence contained in a physical disk, the disk needs to be connected to
the computer via a physical interface. The Physical interface of a hard disk may vary
for different devices, such as, Integrated Drive Electronics (IDE), Small Computer
System Interface (SCSI), Serial ATA (SATA), Universal Serial Bus (USB), IEEE
1394 and eSATA. Each interface may have different variants or revisions with very
different specifications to those of its predecessor. For instance, ATA-6 standard
allows 48-bit Logical Block addressing (LBA) which has maximum disk size 128
Petabyte (PB) whereas ATA-1 standard only allows 28-bit LBA. A disk imaging tool
must be able to recognise different interfaces in order to access the physical disk.
Another factor that might affect the completeness of the forensic image copy is to
identify the true size of the physical disk. A host protected area (HPA), sometimes
known as hidden protected area, exists in some hard disks and is an area that is not
normally visible to the operating system. Gupta et al. (2006) raise concerns in HPA for
digital forensic investigators given the potential of hiding data.
2.3.2 Mandatory Features Of Disk Imaging Tools
According to the disk imaging tool test specification from NIST (2004), some
requirements are mandatory for disk imaging tool and are summarised in Table 2.4.
NIST (2004) also include many other additional requirements that might be useful for
this research. Byers & Shahmehri (2009) also identify some extra requirements based
on NIST (2004) with further interview and discussion with industry experts. Further
requirements identifying how investigation proceeds are reviewed and presented in
chapter 3.
29