Buchanan-Wollaston, J., Storer, T., and Glisson, W. (2013) A comparison of forensic toolkits and mass market data recovery applications. In: Ninth Annual IFIP WG 11.9 International Conference on Digital Forensics, 28-30 Jan 2013, National Center for Forensic Science Orlando, FL, USA.
ID71698.pdf - Accepted Version
Digital forensic application suites are large, expensive, complex software products, offering a range of functions to assist in the investigation of digital artifacts. Several authors have raised concerns as to the reliability of evidence derived from these products. This is of particular concern, given that many forensic suites are closed source and therefore can only be subject to black box evaluation. In addition, many of the individual functions integrated into forensic suites are available as commercial stand-alone products, typically at a much lower cost, or even free. This paper reports research which compared (rather than individually evaluated) the data recovery function of two forensic suites and three stand alone `non-forensic' commercial applications. The research demonstrates that, for this function at least, the commercial data recovery tools provide comparable performance to that of the forensic software suites. In addition, the research demonstrates that there is some variation in results presented by all of the data recovery tools.
|Item Type:||Conference Proceedings|
|Glasgow Author(s):||Glisson, Dr William and Buchanan-Wollaston, Mr Joseph and Storer, Dr Timothy|
|Authors:||Buchanan-Wollaston, J., Storer, T., and Glisson, W.|
|College/School:||College of Arts > School of Humanities > Humanities Advanced Technology and Information Institute (HATII)|
College of Science and Engineering > School of Computing Science
|Copyright Holders:||Copyright © 2013 The Authors|
|Publisher Policy:||Reproduced with the permission of the authors|