Software selection: towards an understanding of forensic software tool selection in industrial practice

Abstract

As a result of the increasing importance of the forensic examination of computer systems, numerous forensic software tools have appeared in the market. The selection of such tools is an important technical and strategic business decision that may have serious legal implications. This paper examines the main issues surrounding the selection of forensic software tools for use by computer forensic investigators pursuing digital evidence as part of an organisational, civil or criminal investigation. The primary objective of this research was to develop a set of characteristics which highlight the main technical and non-technical selection issues and their relative significance in explaining the selection of a particular forensic software tool in industrial practice. This paper presents the results of interviews with commercial forensic investigators in order to assess their attitudes, opinions and experience in making tool selection decisions. In addition a model is developed which describes the main discriminating selection criteria.