Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

ecommended practice according to a variety of digital forensic tool studies (Byers &
Shahmehri, 2009; NIST, 2004; Wilsdon & Slay, 2006; Yinghua & Slay, 2010;
SWGDE, 2009a). A scenario-based testing approach is the most suitable method of
assessing the validity of disk imaging tools.
The proposed research includes five phases and is illustrated in Figure 3.8
below. Disk imaging tools are selected based on the preliminary requirements (see
Table 2.6) and a series of market and vendor researches. Disk imaging tools and their
documentations are acquired and reviewed in phase one. Determination of which disk
imaging tools will be selected for testing will be based on the budget of the study,
reputation and publicity of the tools. Sources of the information are also a subject of
research in relevant research articles, journals, websites, forums and books. Research
budget is another important tool selection criterion. After a list of disk imaging tools
has been selected, the method function mapping adopted from Guo & Slay (2010) will
be used to provide a level of abstraction that would specify the required functions of
disk imaging tools for the forensic software developers, industry practitioners and
other researchers who are conducting their own forensic tools validation. The process
of test requirements specification will be initiated once the function mapping is
completed. CFTT program has made significant progress in specifying the
requirements for the disk imaging function. Testing requirements from CFTT has been
considered as a standard when testing disk imaging tools. In addition, a review of
other releated research conducted in Section 2.2.4 and the documentation of selected
tools will serve as input to requirement specifications in Phase 2. A list of mandatory
and optional requirements is generated. The test requirements are designed based on
the two testing criteria, namely accuracy and completeness. A completed list of
mandatory and optional testing requirements is documented in Appendix 2. Quality of
the test requirements is set through an informal discussion with some experienced
industry experts.
57