Forensic Tool Validation

Overview:

• It's crucial that you validate your forensics tools.  Validation means you've demonstrated that your tool works as it should. In these videos we discuss the concept of validation, the legal requirements for validation, and the methodology used for validation. In addition we've included videos on some freeware tools that you will use for your assignment.

Videos:

• Introduction Forensic Tool Validation (Pollitt)
• Introduction Forenic Tool Validation (Craiger)
• Creating Media for Validation Testing (Craiger)
• Example of Validation Testing (Craiger)
• Tools
• Overview of FTK Imager such as adding a drive, creating a hash of a drive, and creating a disk image. (19 minutes)
• Overview of creating an image and file hashes using ProDiscover
•  How to image and verify a drive using Linux. Use dd to image a drive in Linux, obtain file information with file, and multiple methods to create and view hashes.

Slides:

• Introduction to Digital Forensic Tools

Readings

• Chapter 7 (notes)
• FTK Validation Example