Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

project with detailed research result presented as supporting evidence. In addition, the
paper has provided two significant methods used for evaluation and data analysis with
detailed application in a case study. The research result has shown that AHP, WSM or
a combination of both can benefit the data analysis in the present study.
3.1.5 Function Oriented Methodology to Validate Digital Forensic Tools
The study of Guo & Slay (2010) proposed a function oriented methodology to verify
and validate digital forensic tools. Guo & Slay (2010) first describe the background of
the validation and verification framework within the field of digital forensics. The
methodology proposed by Guo & Slay (2010) can be summarised into five major
stages as illustrated in Figure 3.6. Stage 1 involves the systematic and scientific
understanding of the field of the Electronic Evidence (EE). This stage identifies the
position of the functions in the investigative process. For example, the function
focused only at research was that forensic copy function. The forensic copy function
belongs to the collection phase of the investigative processes reviewed in Section
2.1.2. The forensic copy function was broken down into many sub-functions. After the
function is mapped to different detailed sub-functions, the requirements for forensic
copy function are specified. A variety of diversifications were taken into account when
specifying the requirements. After the requirements were specified, different test cases
were developed according to each identified requirement. However, the authors have
not applied the methodology on any disk imaging tool yet. They state that the tool
would be tested against the test cases and measurement metrics would be applied to
determine the accuracy and precision of the results (Guo & Slay, 2010).
53