Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

various contexts in which a tool can be encountered. Each test scenario consists of a
set of assertions. Different scenarios may have different test assertions and each
assertion is tested at least once. The completed list of test assertions is shown in
Appendix 4.
3.4.1.5 Testing of Disk Imaging Tools
A series of tests are performed in Phase 4, according to the test specifications
developed in Phase 3. The needs for digital forensic software validation and
verification are demanding (Guo et al., 2009). The functionality driven approach is
considered an effective approach for the proposed research since it has been adopted
by many tool evaluation projects such as Lyle (2003), Carrier (2005) and Byers &
Shahmehri (2009). The selected tools are tested against four functionality categories,
namely: fundamental requirements, imaging creation, hidden sectors and logging
function. Each selected disk imaging tool undergoes series of test scenarios and each
scenario composes a series of test assertions developed in Phase 3. The test result for
each test assertion is presented by two rating scales, which are pass and fail. Most of
the test cases share common configuration procedures (see Appendix 5). Defining the
procedures will ensure consistency in test scenarios and will enable other researchers
to replicate or audit this research.
3.4.2 Data Processing Methods
The test result of the tool testing is in the form of different log files generated by the
selected disk imaging tools. The format and the information contained in the log files
are vary from tool to tool. Therefore, the results and the associated information are
collected and summarised into a table, after each test is completed. The table consists
of Test & Case Summary, Test assertion, Information of source device and its setup,
log highlights, test result and analysis. When all the performance tests are completed,
the result of each test will be entered into a spreadsheet to identify the passed and
failed assertions of each test scenario. After the pass rate is identified for each tested
tool, a comparison chart is generated to compare the performance of the selected three
disk imaging tools in each test scenario. The data of this spreadsheet will help the
research to construct a Gap Analysis (GA) matrix.
63