The field of digital forensics has become more prevalent in the court of law due to the increase of availability of technology. With digital evidence coming up in court consistently, digital forensics and its tools are coming under scrutiny and being held against disciplines that are more standardized. Wildson and Slay went so far as to call digital forensics the “neglected family member of the forensic sciences” when discussing the lack of standards in the discipline (Wildson & Slay, 2005, p. 2). In order to begin addressing this issue, we must start looking at the source – the tools. Validation and Verification of tools is vital to maintaining the integrity of the evidence received by them. Utilizing standardized data sets, or forensic corpora, as a part of validation and verification techniques has shown to be effective. This study will replicate Hegstrom (2016). This study will focus on validating the file carving function of Access Data’s Forensic Tool Kit (FTK) using forensic corpora on SATA drives instead of the Solid-State Drives (SSDs) that Hegstrom used. The goal of the study is to assess the use of forensic corpora in the validation and verification of one of the most commonly used digital tools.
Caitlin G. Willimon – 2019
