Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

anomalies are analysed to identify the underlying causes. The finalised test result
reports to Guidance software for review and confirmation.
The research from Byers & Shahmehri (2009) is another good example of a
study that is dedicated to disk imaging tool testing. Their research has many
similarities to the CFTT program but also many improvements were made as well, has
been added value to the research of the CFTT program. For example, Byers &
Shahmehri (2009) developed a rationale of why some variations in some test cases
should be eliminated and a guideline on how to combine variations for clearer test
cases. These elements are absent from the CFTT program. Byers & Shahmehri (2009)
also provide an in-depth analysis of the causes of unsuccessful tests, which are not
provided by the CFTT program. Technical challenges are discussed in the Byers &
Shahmehri (2009a)‟s full research report, which provides an insight into the possible
technical difficulties that may be encountered if their research approach is adopted.
3.1.3 Validating Forensic Software Utilising Black Box Testing Technique
Wilsdon & Slay (2006) proposed an evaluation framework to validate accuracy and
reliability of forensic computing software. Wilsdon & Slay (2006) discussed the needs
for the digital forensic tool evaluation at the beginning. Wilsdon & Slay (2006)
pointed out that the evaluation framework of digital forensic tools from NIST and
SWGDE is incapable of fulfiling the rapid demand of the industry because it can take
up to months to evaluate a single piece of software thoroughly. CFTT program cannot
test every single disk imaging tool in the market. The purpose of Wilsdon & Slay
(2006) research is to develop and implement a more efficient testing framework than
NIST and SWGDE with regarding to time, financial and output constraints. The
differences regarding the reliability between proprietary and open source software are
also discussed. The testing framework is built based on the software testing standards
of ISO 17025-2005 and IEEE 610.12-1990.
A six-step evaluation process is developed in the research and illustrated in
Figure 3.3. Software applications are acquired for evaluation at the beginning of the
cycle. The documentation of software applications must satisfy standards ISO 17025-
2005 and Australian Standard (AS) 4006-1992.
48