By: Latoya Nicole Rutherford
Norfolk State University, 2012
Advisor: Dr. Jonathan Graham
Digital forensics, typically in relation to a computer crime investigation, is the collection, preservation, acquisition, analysis, and presentation of digital evidence. During a forensic investigation, an investigator or examiner use open-source and commercial forensic tools to perform the following tasks: gather the devices suspected in the crime, protect the integrity of the data on the devices using write blockers, capture a forensic image of the device, look for evidence within the image, and finally produce a report of their findings. To complete these tasks, investigators and examiners utilize open-source forensic tools. Our research problem focuses on whether or not open-source forensic tools are a viable alternative to the commercial forensic tools currently being used in digital forensic investigations. We believe government agencies, law enforcement and universities that offer digital forensic courses, can save thousands of dollars by using freely available open-source forensic tools. However because of the barriers that can be met using open-source forensic tools, such as losing billions of dollars in high profile cases due to inadmissibility of evidence, they choose commercial software forensic tools for assurance purposes. We compared open-source and commercial forensic tools based on performance metrics that reflect common actions taken by investigators and examiners during acquisition, analyzing and reporting stages in digital forensic investigations. The results from our detailed comparative analysis indicate that the open-source and commercial forensic tools used in this research were consistent with small variances in the amount of data extracted from the images. The comparative analysis charts indicate that open-source software forensic tools closely and comprehensively provide the same results as commercial software forensic tools. The comparative analysis charts also prove that using open-source forensic is a viable alternative to commercial forensic tools.