Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

3.4.1.3 Tool Testing Requirements ................................................................... 62
3.4.1.4 Development of Test Scenarios ............................................................. 62
3.4.1.5 Testing of Disk Imaging Tools .............................................................. 63
3.4.2 Data Processing Methods ................................................................................... 63
3.4.3 Data Analysis Methods ....................................................................................... 64
3.4.3.1 Gap Analysis (GA) ................................................................................ 60
3.5 Limitations of the Research ........................................................................................ 65
3.6 Conclusion .................................................................................................................. 67
Chapter 4. Research Findings
4.0 Introduction ................................................................................................................. 69
4.1 Variations in Research Specifications ........................................................................ 70
4.1.1 Data Collection ................................................................................................... 70
4.1.2 Data Processing & Analysis ............................................................................... 71
4.2 Field Findings ............................................................................................................. 71
4.2.1 Testing Environments ......................................................................................... 71
4.2.2 Field Findings: Disk Imaging Tools Evaluation ................................................. 74
4.2.2.1 TC-01: Acquiring Various Physical Interfaces ..................................... 74
4.2.2.2 TC-02: Acquiring Various Digital Sources ........................................... 75
4.2.2.3 TC-03: Acquiring A Hard Drive with Hidden Sectors .......................... 75
4.2.2.4 TC-05: Acquire A Digital Source in an Alternate Supported Format ... 76
4.2.2.5 TC-06: Acquire a Digital Source with Unresolved Read Error ............. 77
4.2.2.6 TC-07 & TC-08: Insufficient Space at Destination Device .................. 78
4.2.2.7 TC-09: Verify a Correct Image ............................................................. 79
4.2.2.8 TC-10: Verify a Corrupted Image ......................................................... 79
4.2.2.9 TC-11: Convert Existing Image Files to another Image Format ........... 80
4.2.2.10 TC-12 (1&2): Acquire Partition Partially or Completely Hidden ....... 81
4.2.2.11 TC-13: Acquire Overlapping Partitions .............................................. 82
4.2.2.12 TC-14: Partitions Out of Physical Boundary ....................................... 82
4.2.2.13 TC-15: Acquire a Hard drive with a Unreadable MBR ....................... 83
4.2.2.14 TC-16(1): Acquire a Single GUID Partition ....................................... 84
4.2.2.15 TC-16(2): Acquire a GPT Disk ........................................................... 85
4.2.2.16 TC-17: Acquire a partially hidden GPT Partition ............................... 85
4.2.2.17 TC-18: Acquire Single Partition using Local Network Connection .... 86
viii