Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Stage 1
Acquire the Software
Stage 2
Identification of software
functionalities
Stage 3
Development of test
cases & Reference sets
Stage 4
Development of result
acceptance spectrum
Stage 5
Execute tests & evaluate
results
Stage 6
Release evaluation
results
Figure 3.3. Forensic computing software evaluation process from Wilsdon & Slay (2006)
Signature of the software applications must be obtained using MD5 checksum or other
hash functions to ensure the future updates of the software can be distinguished easily
from the tested one. Software functionalities are identified according to the
documentation provided or other sources such as discussion board, vendor websites,
and related community input. All the functions must be identified and properly
documented as an item to be tested. Completed documentation of all available
functions in stage 2 will directly affect the output of stage 3. Test cases are developed
based on black-box testing technique and all the test data is organised to test all
identified functions. The organisation of collected data sets is presented as a reference
set. The same reference set can apply in different contexts with the same functionality.
Reference sets can be made available to the community to review the completeness
and accuracy. The software may be used in different environments (Law enforcement,
military, and commercial) and different levels of acceptance can be identified. The
49