Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

can be categorized as textual value, numerical value or other type of value. The value
of each criterion defined in this research is textual value.
Ratings “passed” and “failed” are sufficient enough to identify the gap between
the requirements and the actual performance of the tool. Vatis (2004) adopted the
technique of GA matrix in a national research on investigating the gap between the
cyber-attacks and the law enforcement security tools.
Table 3.1
Example of Gap Analysis Matrix
Criteria
Product
FTK Imager Helix 3 Pro AIR
Requirement 1 PASSED FAILED PASSED
Requirement 2
……………
Requirement X
Figure 3.11 illustrates the mapping of the research questions to the research stages.
The data map demonstrates how the research questions will be answered in a logical
and scientific manner. Figure 3.11 also illustrates the detail flow of logics how this
research is conducted.
3.5 LIMITATIONS OF THE RESEARCH
The proposed research proposes to examine the performance of the selected disk
imaging tools in different validity tests. However, certain limitations are expected in
the proposed research.
A manageable number of disk imaging tools are tested against the designed test
scenarios in the proposed research. Many other disk imaging tools are available on the
market at variable cost but this investigation is focuses on the selected tools. No
attempt is made for the findings to be representative but rather a case is built on the
use of well-known tools. The main problem of this approach is overgeneralisation and
also a sense of incompleteness as there are many other software tools that could be
tested.
65