Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

answered. Details of data collection, processing, analysis and presentation are
presented in section 3.4. The data mapping that links the question to the different data
types and the hypothesis tests is shown in Figure 3.11. The limitation of the research
will be discussed in section 3.5 and followed by a conclusion.
3.1 REVIEW OF SIMILAR STUDIES
Five relevant studies will be critically reviewed to analyse how other researchers are
defining and implementing methodologies in areas related to the proposed research.
The focus of Chapter 2 is on the definition of what is important in the area of digital
forensic disk imaging tools. The task of Chapter 3 is to identify how to conduct the
research in the topic area.
3.1.1 Standardised Approach Of Testing Disk Imaging Tools From NIST
The CFTT program is a joint project between a few organisations in the United States
of America including NIJ, DOJ and NIST. The aim of the CFTT program is to actively
provide a measure of assurance that the tools used during the investigation of digital
crimes produce aacurate and complete results. The program addresses one key
problem of the industry and legal community. This problem is that there is no standard
or credible test to validate the accuracy and completeness of the result extracted by
disk imaging tools. The test results are able to assist the forensic software vendors to
improve their tools and provide best practice reference to support the results produced
by those tools for presentation in the court. The primary studies of NIST (2004) and
NIST (2005) of CFTT program present the testing of disk imaging tools. The studies
initiated by NIST have a direct link to the proposed research because the approach
taken has been widely recognised and acknowledged by the scientific and legal
community. NIST is also one of the few research organisations dedicated to digital
forensic tool testing.
NIST implements a systematic approach to identify and test the tool
requirements. Figure 3.1 illustrates the methodology used by NIST for their disk
imaging tool testing. They suggest that at the beginning, the category of forensic
requirements will be determined by a group of expert users.
44