Testing Computer Forensic Tools

Feb 25, 2004

Abstract

There is a critical need in the law enforcement community to ensure the reliability of computer forensic tools. A capability is required to ensure that forensic software tools consistently produce accurate and objective test results. The goal of the Computer Forensic Tool Testing (CFTT) project at the National Institute of Standards and Technology (NIST) is to establish a methodology for testing computer forensic software tools. A methodology consisting of tool requirements specifications, test procedures, test criteria, test sets, and test hardware has been developed.



There are significant challenges for testing forensics tools. First, there are no standards or specifications for the expected behavior of forensic tools. Second, very arcane and often undocumented knowledge is required to understand the critical testing issues. Third, the behavior of the tools when executed in the presence of hardware errors is critical.



Several lessons learned during the testing of widely used tools are discussed. For example, the behavior of an imaging tool used on an unreliable (i.e., has bad sectors) disk is of interest. However, an unreliable disk is just that, unreliable. For testing, a reliable bad disk is needed. This was accomplished by using software to simulate a disk with bad sectors on a normally functioning hard disk.