A comparison of forensic toolkits and mass market data recovery applications

Buchanan-Wollaston, J., Storer, T. and Glisson, W. (2013) A comparison of forensic toolkits and mass market data recovery applications. In: Ninth Annual IFIP WG 11.9 International Conference on Digital Forensics, National Center for Forensic Science Orlando, FL, USA, 28-30 Jan 2013,

[img]
Preview
Text
ID71698.pdf - Accepted Version

255kB

Abstract

Digital forensic application suites are large, expensive, complex software products, offering a range of functions to assist in the investigation of digital artifacts. Several authors have raised concerns as to the reliability of evidence derived from these products. This is of particular concern, given that many forensic suites are closed source and therefore can only be subject to black box evaluation. In addition, many of the individual functions integrated into forensic suites are available as commercial stand-alone products, typically at a much lower cost, or even free. This paper reports research which compared (rather than individually evaluated) the data recovery function of two forensic suites and three stand alone `non-forensic' commercial applications. The research demonstrates that, for this function at least, the commercial data recovery tools provide comparable performance to that of the forensic software suites. In addition, the research demonstrates that there is some variation in results presented by all of the data recovery tools.

Item Type:Conference Proceedings
Status:Published
Refereed:Yes
Glasgow Author(s) Enlighten ID:Buchanan-Wollaston, Mr Joseph and Storer, Dr Tim and Glisson, Dr William
Authors: Buchanan-Wollaston, J., Storer, T., and Glisson, W.
College/School:College of Arts & Humanities > School of Humanities > Information Studies
College of Science and Engineering > School of Computing Science
Copyright Holders:Copyright © 2013 The Authors
Publisher Policy:Reproduced with the permission of the authors

University Staff: Request a correction | Enlighten Editors: Update this record