Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

connected to the computer using a PI and the disk imaging tool will acquire the device
by some command sets or protocols (NIST, 2005). In Figure 3.9, AM and PI combined
will allow the disk imaging tool to run in an EE to acquire the DS. The DS will be
stored in the DD. NIST (2005) refers the combination of AM and PI as Access
Interface. For instance, a hard disk connects to the computer using a SATA PI and
accesses the drive using the AM ATA command set. The disk imaging tool will run on
top of the EE Microsoft Windows using some command sets or protocols and acquire
the DS and save it into the DD of an external hard disk.
The Digital Source scheme contains two major classifications that are
nonvolatile data and volatile data. Nonvolatile data is the information residing on a
storage medium such as hard disk and the data will be retained in the medium even
when the power is off. Volatile data does not fall into the research scope therefore the
sub-section will not be expanded to a detailed level. In the field of digital forensics,
investigators usually acquire the evidence in two ways: making a physical copy or a
logical copy of the selected data. Making a physical copy of the evidence means every
bit of the data in the storage medium will be read, acquired and stored as another copy
in an external data destination (Refer to section 2.3 for more details). According to
Guo & Slay (2010), physical copy can be divided into three common types which are
magnetic, optical and semi-conductor. Optical and semi-conductor types are omitted
because they do not fall in the scope of this research. Magnetic type can be further
divided into two sub-categories, namely raw and structured. Category raw represents
the data when it contains only data but nothing else. An example of the raw data could
be DD raw image format. Category structured may contain other information that
might be useful for the forensic investigators such as hash information, compression
level and time of acquisition. EnCase, SMART and Advanced Forensics Format
(AFF) could be the examples of the structured data.
60