Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

experts will be used to narrow down to a small number of test cases. Finally a set of
relevant test cases that contain a group of test assertions are identified. International
guidelines and standards such as the International Organization for Standardization
(ISO) / International Electrotechnical Commission (IEC) 17025 are adopted to
standardise the test procedures and methods. NIST runs tests on selected tools and
produces test reports according to the testing plan and procedures. Vendor and Steer
Committee review the final test report and release the report to the public. The
methodology used by the CFTT program is a systematic approach that is highly
organised, robust and credible. Each step is reviewed and revised by experts from law
enforcements and forensics communities. Test scenarios, tool requirements and test
assertions can be modified and adopted in the proposed research. Also, the support
software tools developed by NIST can improve efficiency of the testing process and
also avoid unexpected problems arising from using untested software. From the test
report, the test result is repeatable and reproducible. The test report serves as a
reference point for the research to compare and analyse the test results that can
identify any underlying problems.
3.1.2 Enhanced Approach For Disk Imaging Tools Evaluation
Byers & Shahmehri (2009) aim to provide a systematic approach to test disk imaging
tools since tool testing is challenging, time consuming and expensive. Also, only few
publications have been published in areas of digital forensic tool testing. The study
focuses on evaluating Encase 6.8 and Linen 6.1 (Linux version of Encase), both
developed by Guidance Software. The purpose of the evaluation in this research is the
same as that of the CFTT program. Studies from the CFTT program and Byers &
Shahmehri (2009) try to determine if the disk imaging tools used during the
investigations perform as expected and produce accurate and completed results.
Studies from Byers & Shahmehri (2009) have similarities to the CFTT program but
also many major differences are identified during their evaluation. The methodology
adopted by Byers & Shahmehri (2009) is shown in Figure 3.2. As the first phase,
generic testing requirements are identified from three sources, namely formal
46