Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Stage 1
Understand the discipline of
Electronic Evidence (EE)
Stage 2
Specific fundamental functions in
EE investigative processes through
Function Mapping
Stage 3
Specific test requirements for each
identified functions
Stage 4
Develop test scenarios to test the
identified functions
Stage 5
Execute the tests on the test
subjects
Figure 3.6. Process of Function Oriented Paradigm from Guo & Slay (2010)
The effort made by Guo & Slay (2010) is another notable research in digital forensic
tools validation. The methodology adopted in this research is a systematic and
scientifically sound approach to validate digital forensic tools. Compared to the
traditional testing methods, the approach used in this research is extensible and tool
neutrailised. As more requirements are found, they can be added to the specifications
without compromising the entire framework. The approach is functionality oriented
and it does not matter to what tool it is applied.
Unfortunately, this methodology has not been applied on any tools yet to
evaluate its weaknesses or shortcomings. The development of the reference set in the
research by Guo & Slay (2010) has a potential problem. The problem is that the
authors have specified extensible function requirements and they assumed that the
corresponding reference set (test scenarios) were also extensible. Each function
requirement may have serveal variables that lead to different variations. But Guo &
Slay (2010) missed out the possible combination of those variables that maybe
54