Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

3.4.3 Data Analysis Methods
GA is adopted as the data analysis method in the proposed research. GA is able to
identify the differences of the final scores and to reveal the relative superiority
between the evaluated tools. GA compares the measured values to the required values
based on the criteria. For example, Figure 3.10 illustrates three possible results that
might be achieved during the evaluation on selected tools. Figure 3.10(a) shows the
selected tool meets the test requirements. The second result in Figure 3.10(b) shows
that the selected tool only partially fulfils the test requirements, while the third case
(Figure 3.10c) is when the selected tool may fulfil some or all the test requirements, as
some of the features may fall outside the boundary of the defined requirements (Sheng
& Wang, 2008).
A GA evaluation matrix is designed to assess the gap between the selected
tools and the defined requirements. The gap can be identified as:
Gap = Required Requirements – Actual performance of the Tool
Figure 3.10. Example of Gap Analysis (Sheng & Wang, 2008, p.1249).
An example of GA matrix is demonstrated in Table 3.1. The testing requirements
defined in Phase 2 are considered as differentiated factors to identify the gap between
the three selected disk imaging tools. The value for each criterion against each product
64