Testing Forensic Copy Function of Computer Forensics Investigation Tools

Abstract

The growth in the computer forensic field has created a demand for new software (or increased functionality to existing software) and a means to verify that this software is truly forensic (i.e., capable of meeting the requirements of the trier of fact). In this work, we present a function-oriented testing framework for validation and verification of computer forensic tools. This framework consists of three parts: function mapping, requirements specification, and reference set development. Through function mapping, we give a scientific and systemical description of the fundamentals of computer forensic discipline; i.e., what functions are needed in the computer forensic investigation process. We focus this article on the forensic copy function. We specify the requirements and develop and a corresponding reference set to test any tools that possess the forensic copy function.