Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Automated Image and Restore (AIR) is an important constituent of the CAINE
(Computer Aided Investigative Environment) project. CAINE is a specialised digital
forensics environment based on GNU/Linux Ubuntu distribution. It offers a complete
interoperable forensic environment that supports the collection, examination, analysis
and reporting phases of digital investigations. CAINE provides a user-friendly
graphical interface and the most important advantage of the project is that is Open
Source and completely free. As Helix has become payware, CAINE has been
nominated as an alternative to Helix3 as a popular free digital forensic toolkit
(Gleason, 2009).
This research has a very limited budget and the choice of the disk imaging
tools are tending to open source software or freeware. The selection of the disk
imaging tools is also base on their functionalities provided. The candidate disk
imaging tools must be satisfying the fundamental requirements defined in Appendix 2.
The selection is also base on the availability of the software and the testing
environment. For example, Mac OS X environment is not available for testing and the
disk imaging tools that operating solely in this environment is not included in this
study.
2.5 SUMMARY OF KEY ISSUES & PROBLEMS
The history of computer forensics can be traced back to 1970‟s and yet it is still an
immature field. Computer technology has been more commonly used in people‟s daily
life and its greater usage can lead to a great increase in court cases that involve the use
of digital evidence.
The complexity and difficulty have significantly increased for digital
investigations due to the large amount of data involved in today‟s computing
environment. Also, digital crimes can be remotely triggered and their investigations
may cross multiple-jurisdictional borders with an unknown number of suspects. Many
research groups, government sections and organisations have attempted to build
standardised frameworks for digital investigation. However, a globally recognised
investigation framework is yet to be established. A standardised scientific approach
for digital investigation must be built to provide the foundation or common practice
39