Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Determine categories of
forensic requirements
Identify
requirements for a
specific category
Convert
requirements to
test assertions
Identify relevant
test cases
Develop test
procedures and
method
Run tests
Steering
Committee
reviews test report
Vendor reviews
test report
Develop test code
for test assertions
45
Report release to
public review and
comment
Figure 3.1. Methodology of disk imaging tools evaluation from NIST (2001)
More precise requirements are then identified by forensic specialists and used to
conduct tool testing. With category requirements defined, a list of requirements for the
specific category will be identified by a group of local and national experts and the
final requirements will be finalised by a consensus reviewed by forensic community
users and public. A revision will be made and incorporated into the new testing
specifications. The requirements identified are high level and may not be testable. It is
necessary to convert the requirements to test assertions that bridge the gap between
test specification and test scenarios. A test case includes one or more test assertions to
specify what needs to be tested. Public review and opinion from forensic community