Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Table 2.4<br />
Mandatory features <strong>of</strong> <strong>Disk</strong> Imaging <strong>Tools</strong> (NIST, 2004, p.8)<br />
Requirements Description<br />
DI-RM-01<br />
DI-RM-02<br />
DI-RM-03<br />
DI-RM-04 & 05<br />
DI-RM-06<br />
DI-RM-07<br />
DI-RM-08<br />
The tool shall be able to acquire a digital source using each access<br />
interface visible to the tool.<br />
The tool shall be able to create either a clone <strong>of</strong> a digital source, or an<br />
image <strong>of</strong> a digital source, or provide the capability <strong>for</strong> the user to<br />
select and then create either a clone or an image <strong>of</strong> a digital source.<br />
The tool shall operate in at least one execution environment and shall<br />
be able to acquire digital sources in each execution environment.<br />
The tool shall completely acquire all visible and hidden data sectors<br />
from the digital source.<br />
All data sectors acquired by the tool from the digital source shall be<br />
accurately acquired.<br />
If there are unresolved errors while reading from a digital source then<br />
the tool will notify the user <strong>of</strong> the error type and the error location.<br />
If there are unresolved errors while reading from a digital source then<br />
the tool will notify the user.<br />
2.3.3 Current <strong>Disk</strong> Imaging <strong>Tools</strong><br />
The purpose <strong>of</strong> surveying different disk imaging tools is to understand the state-<strong>of</strong>-the-<br />
art <strong>of</strong> the tools and filter out the best available tools to conduct per<strong>for</strong>mance<br />
evaluations on them. There are two types <strong>of</strong> disk imaging tools in the market, namely<br />
hardware-based and s<strong>of</strong>tware-based. Hardware-based disk imaging tools usually have<br />
much better per<strong>for</strong>mance over s<strong>of</strong>tware-based disk imaging tools. Corresponding to<br />
the per<strong>for</strong>mance, the cost is much higher than the s<strong>of</strong>tware-based disk imaging tools.<br />
Hardware disk imaging tools usually come in a toolkit style with plenty <strong>of</strong> accessories<br />
such as different types <strong>of</strong> physical interfaces, adapters and cables to acquire different<br />
type <strong>of</strong> devices. Hashing verification, write blocking and read multiple devices<br />
simultaneously are the common functions hardware-based disk imaging tools (see<br />
Table 2.5) will provide. Logicube Talon, HardCopy 3 from Voom Technologies, <strong>Data</strong><br />
Copy King from SalvationDATA and TableauTD1 from Guidance S<strong>of</strong>tware are some<br />
commonly used hardware disk imaging tools.<br />
An alternative to the pricey Hardware-based disk imaging tools are S<strong>of</strong>tware-<br />
based solutions. The most commonly seen file copying program is DD and it was first<br />
30
Change language