Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

3.4.1 Data Collection Methods
Different data collection methods adopted in the proposed research are explained in
the following sub-sections.
3.4.1.1 Market And Vendor Research And Internet Survey
Market and Internet survey and vendor research are among the common approaches to
screen and select candidate software for a software evaluation project (Maiden &
Ncube, 1998; Kunda & Brooks, 1999; Kontio, 1996). More than 50 open-sourced and
proprietary vendors have been researched against the preliminary requirements and the
research budget. Information reviewed includes the software user manuals, publically
released notes, updated histories, consumer reports, user comments and related forum
entries. A list of three candidate software is presented in Phase 1.
3.4.1.2 Function Mapping
Before the complete set of requirements is developed, a function map is created to
map each identified function to the requirements of disk imaging tools. After each
function and its sub-functions are identified, the requirements corresponding to each
function category will be specified. Guo & Slay (2010) mentioned that function
mapping can provide a level of abstraction of functions that should be included or
tested for the tool testers or software developers. Byers & Shahmehri (2009) also
employed similar method to identify more potential requirements for tool testing. The
function map is tool independent and it can be applied to any disk imaging tools. Tool
developers, testers and analysts can adapt the function map to identify their own
requirements and start testing the tool in a focused and organised approach. Figure 3.9
depicts the function map built in a way that it can be reused to create suitable
requirements for any disk imaging tools.
The function map (Figure 3.9) consists of six major schemes, namely Access
Method (AM), Digital Source (DS), Data Destination (DD), Execution Environment
(EE), Hidden Areas (HA) and Physical Interface (PI). The definitions of six major
schemes can be found in Appendix 1. Each major scheme may have few sub-sections.
Due to space limitation, function map only presents the important parts that are
relevant to this research. To access the DS from the device, the device needs to be
59