Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
aimage is a promising tool but the documentation and support are very limited which<br />
makes the validation difficult. The usage <strong>of</strong> this tool is still very limited in the current<br />
digital <strong>for</strong>ensic practices.<br />
2.3.3.6 Windows-based Imaging tools<br />
Most windows-based imaging tools <strong>of</strong>fered are proprietary and packaged inside a<br />
toolkit. Some commonly used tools are EnCase, FTK Imager, <strong>Forensic</strong> Replicator<br />
from Paraben, WinHex from X-way S<strong>of</strong>tware and ProDiscover® <strong>Forensic</strong>s.<br />
Access<strong>Data</strong> made FTK Imager as a separate program that is available as freeware and<br />
comes with excellent support and documentation. The Lite version <strong>of</strong> FTK Imager<br />
does not require installation and it can be integrated into a collection <strong>of</strong> <strong>for</strong>ensic tools.<br />
Due to the limited timeframe and budget <strong>of</strong> this research, proprietary disk imaging<br />
toolkits are not considered in this research.<br />
2.3.3.7 Macintosh Imaging tools<br />
Apple computers are becoming more popular. The latest electronic devices iPhone and<br />
iPad have sold tens <strong>of</strong> millions units in the consumer market. However, the field <strong>of</strong><br />
Macintosh <strong>for</strong>ensics is still growing and only a handful <strong>of</strong> companies have developed<br />
<strong>for</strong>ensic s<strong>of</strong>tware that targets Apple devices. BlackBag Technologies and<br />
Mac<strong>Forensic</strong>sLab are two leading companies that specialise in Macintosh <strong>Forensic</strong>s.<br />
2.3.4 Problem Areas In <strong>Disk</strong> Imaging <strong>Tools</strong> - <strong>Data</strong> Hiding<br />
<strong>Data</strong> Hiding is an anti-<strong>for</strong>ensic technique that has existed <strong>for</strong> as long as there have<br />
been digital computers. The technique has been further utilised by sophisticated<br />
criminals and hackers to conceal incriminating data in the storage device to avoid<br />
detection by digital <strong>for</strong>ensic tools. <strong>Data</strong> hiding is also a major hazard <strong>for</strong> the law<br />
en<strong>for</strong>cement conducting <strong>for</strong>ensics investigation. Berghel (2007, p.18) has presented<br />
eleven possible locations to conceal data in a disk drive. Slack spaces, unallocated<br />
space and unused space are the most common locations to conceal the data. However,<br />
some special tools may require storing data in these locations. On the other hand, Host<br />
Protected Area (HPA) and Device Configuration Overlay (DCO) area are more<br />
commonly used in today‟s computing world. Typically, HPA and/or DCO can be<br />
located in laptop computers. Computer vendors usually create HPA or DCO reserved<br />
33
Change language