SLAMorris Final Thesis After Corrections.pdf - Cranfield University

structure and behaviour. Winhex provides an analyst with various tools, such as
the ability to create scripts and templates to make working with large files
easier; it also contains a data interpreter which converts selected hex into other
formats [Casey, 2004]. Such tools make working with hex easier and less time
consuming, allowing an analyst to concentrate on their analysis. They are often
particularly useful in analysing unknown binary file structures as they provide an
interface to examine, compare and deconstruct files.
There is significant debate within the forensic community about the relative
merits of open and closed source software. Whilst both have been shown to
meet the requirements for tools used to produce evidence, open source tools
have been shown to do this more comprehensively [Carrier, 2002]. Whilst the
source code is not available for closed source tools any tool used during an
analysis should use documented procedures; the results of a tool should also
be corroborated using another method to provide independent verification.
Creating a new open source method allows analysts the opportunity to explore
the source code used and fully analyse the tools behaviour. Carrier suggests
that this should be accompanied by written documentation on the procedures,
to supplement the analyst’s understanding.
Ensuring that any new tool created uses a layout that is similar to existing
forensic tools will make it easier to train analysts in its use [Richard, 2005]. The
tools interface should also conform to the standard layout of functions used by
the operating system, making it intuitive to use. Providing the analyst with
information about the processes being performed by the software and its status
will ensure they are aware of its behaviour.
Page 19