Testing Digital Forensic Software Tools Used in Expert Testimony-Reference-Cited by-同舟云学术

Testing Digital Forensic Software Tools Used in Expert Testimony

Published:2010 Issue: Volume: Page:257-278
ISSN:2327-0381
Container-title:Handbook of Research on Computational Forensics, Digital Crime, and Investigation
language:
Short-container-title:

Author:

Batten Lynn M.¹,Pan Lei¹

Affiliation:

1. Deakin University, Australia

Abstract

An expert’s integrity is vital for the success of a legal case in a court of law; and witness experts are very likely to be challenged by many detailed technical questions. To deal with those challenges appropriately, experts need to acquire in-depth knowledge and experience of the tools they work with. This chapter proposes an experimental framework that helps digital forensic experts to compare sets of digital forensic tools of similar functionality based on specific outcomes. The results can be used by an expert witness to justify the choice of tools and experimental settings, calculate the testing cost in advance, and be assured of obtaining results of good quality. Two case studies are provided to demonstrate the use of our framework.

Publisher

IGI Global

Reference22 articles.

1. Defining digital forensic examination and analysis tools using abstraction layers.;B.Carrier;International Journal of Digital Evidence,2003

2. Carrier, B. (2005). File system forensic analysis. Reading, MA: Addison-Wesley.

3. Casey, E. (2002). Error, uncertainty, and loss in digital evidence. International Journal of Digital Evidence, 1(2). CFTT group from NIST. (2001). Disk imaging specifications (Tech. Report). NIST. CFTT group from NIST. (2004). Digital data acquisition tool specification (Tech. Report). NIST. CFTT group from NIST. (2005). Digital data acquisition tool test assertions and test plan (Tech. Report). NIST.

4. DFRWS-06. (2008). DFRWS-06 website. Retrieved from http://www.dfrws.org/2006/challenge/

5. DFTT. (2008). DFTT testing website. Retrieved from http://dftt.sourceforge.net/