Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Testing
requirements
Selected disk
imaging tools
Input
1. Test Scenarios
2. Test Procedures
3. Configuration of Test
Environment
Figure 3.7. Research model.
56
Tests
Performance
of the selected disk imaging
tools in terms of Accuracy
& Completeness
The hypotheses about the performance between the testing and the validity of the
selected disk imaging tools are as follow:
H1: FTK Imager will perform better than the other two selected disk
imaging tools in most of the common test cases;
H2: Helix 3 Pro will perform better than AIR Imager in most of the
common test cases;
H3: AIR will perform better than the other two selected disk imaging
tools in a very few common test cases.
According to the literature reviewed in sections 2.2.2, 2.2.4.2 and 2.3.1, accurancy and
completeness are two important criteria for evaluating the performance of disk
imaging tools. Therefore, the research aims to find out which disk imaging tools are
most successful under various testing scenarios.
3.3 THE RESEARCH MODEL
The five studies reviewed in Section 3.1 have investigated the standardised approach
and other potential methods of assessing digital forensic disk imaging tools. The main
objective that needs to be established is to empirically verify the validity of digital
forensic disk imaging tools. The essential element of this research is to execute a
series of test scenarios on the selected disk imaging tools based on the defined test
requirements. It should be noted that the testing utilises black-box testing techniques
by executing a set of pre-defined test scenarios to investigate the validity of disk
imaging tools in a logical and standardised approach. Utilising test scenarios based on
a set of pre-defined requirements to verify disk imaging tools is a common and