Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

2.3.3.1 dcfldd ....................................................................................................... 31
2.3.3.2 dc3dd ........................................................................................................ 32
2.3.3.3 Helix 3 Pro ............................................................................................... 32
2.3.3.4 Automated Image and Restore (AIR) ...................................................... 32
2.3.3.5 Aimage ..................................................................................................... 32
2.3.3.6 Windows-based Imaging Tools ............................................................... 33
2.3.3.7 Apple Macintosh Imaging Tools ............................................................. 33
2.3.4 Problem Areas in Disk Imaging Tools – Data Hiding ...................................... 33
2.3.4.1 Host Protected Area (HPA) ..................................................................... 34
2.3.4.1 Device Configuration Overlay (DCO) Area ............................................ 35
2.3.5 Problem Areas in Disk Imaging Tools – Master Boot Record (MBR) &
GUID Partition Table (GPT) ............................................................................ 35
2.3.6 Problem Areas in Disk Imaging Tools – Hash Function ................................... 36
2.4 The Functionalities of Selected Disk Imaging Tools .................................................. 37
2.5 Summary of Key Issues and Problems ....................................................................... 39
2.6 Conclusion .................................................................................................................. 41
Chapter 3. Research Methodology
3.0 Introduction ................................................................................................................. 43
3.1 Review of Similar Studies .......................................................................................... 44
3.1.1 NIST Standardised Approach of Disk Imaging Tools Testing ........................... 44
3.1.2 Enhanced Approach for Disk Imaging Tools Evaluation ................................... 46
3.1.3 Validating Forensic Software Utilising Black Box Testing Techniques ............ 48
3.1.4 Applying Systematic Method for Commercial Off-the-shelf (COTS)
Selection ............................................................................................................ 50
3.1.5 Function Oriented Methodology to Validate Digital Forensic Tools ................. 53
3.2 Research Questions and Hypotheses .......................................................................... 55
3.3 The Research Model ................................................................................................... 56
3.4 Data Requirements ...................................................................................................... 58
3.4.1 Data Collection Methods .................................................................................... 59
3.4.1.1 Market and Vendor Research and Internet Survey ................................ 59
3.4.1.2 Function Mapping ................................................................................. 59
vii