A Function Oriented Methodology to Validate and Verify Forensic Copy Function of Digital Forensic Tools

The growth in the computer forensic field has created a demand for new software (or increased functionality to existing software) and a means to verify that this software is truly forensic i.e. capable of meeting the requirements of the trier of fact. In this work, we present a function oriented testing framework for validation and verification of computer forensic tools. This framework consists of three parts: function mapping, requirements specification and reference set development.Through function mapping, we give a scientific and systemical description of the fundamentals of computer forensic practice, i.e. what functions are needed in the computer forensic investigation process. We focus this paper on the forensic copy function. We specify the requirements and develop and a corresponding reference set to test any tools that possess the forensic copy function.