Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

the images or the clone copy created are exact duplicates of the original drive (Wang,
Lai, Feng, Chen, & Yu, 2005, p.123). Comparing the hash value generated from the
original content and the hash value derived from the image files will certain that the
two copies of data are identical. In other words, the integrity of the original and
imaged data is ensured. The most popular Hash functions adopted by disk imaging
tools are Message Digest 5 (MD5), Secure Hash Algorithm version 1, 256 and 512
(SHA-1, SHA-256, SHA-512).
Hash function is built on the concept of collision-resistant. However, Wang,
Feng, Lai, & Yu (2004) and Wang et al. (2005) have presented some popular hash
functions that could generate same hash value on two different inputs. Malinowski &
Noble (2007) referred the collision problem or hashing attack as “pigeon-hole
problem” and that the problem exists in any algorithm. What are the ramifications of
this problem to digital forensics? Thompson (2005) presents three arguments that the
research of hash function collision problem should have little impact in computer
forensics where the hash function is being used as method of evidence authentication.
Firstly, the collision problem presented by Wang et al. (2004) can only be produced in
a very particular piece of input content. Secondly, the hash function MD5 is not
vulnerable to a brute force attack. It is still infeasible to alter the content of an input
message and the hash value of the new message still to match the pre-calculated hash
value on the original content. Furthermore, the chance of the collision attack is
incredibly small and the problem presented by Wang et al. (2004) requires specific
type of data and environment to occur.
2.4 THE FUNCTIONALITIES OF SELECTED DISK IMAGING TOOLS
Three disk imaging tools are selected for performance testing and their functionalities
and advantages are discussed below and summarised in Table 2.6.
FTK Imager is a disk imaging tool provided by AccessData as a freeware. FTK
Imager is an important component of the FTK toolkit, a world-class digital forensic
tool. Evaluating FTK Imager will create a comparison baseline to the CFTT program
to determine the accuracy of the project testing environment.
37