Title: 4. Validating and Testing Forensic Software
Course: IN 2005 Digital Forensics > Section: Module 7: Chapter 7 - Current Computer Forensics Tools

Validating and Testing Forensic Software

1. It is very important to preserving the integrity of your evidence, especially if it is admitted to court.

Using National Institute of Standards and Technology (NIST) Tools

1. The NIST’s Computer Forensics Tool Testing (CFTT) program manages research on computer forensics tools.
2. NIST has created criteria for testing computer forensics tools based on standard testing methods, the ISO 17025 criteria for testing items that have no current standards and the ISO 5725.
3. Your lab must meet the following criteria and keep accurate records so that when new software and hardware become available, testing standards are in place for your lab:
  - Establish categories for computer forensics tools
  - Identify computer forensics category requirements
  - Develop test assertions
  - Identify test cases
  - Establish a test method
  - Report test results
4. NIST has also developed several tools for evaluating drive-imaging tools including the Forensic Software Testing Support Tools (FS-TST).
5. The National Software Reference Library (NSRL) project collects all known hash values for commercial software applications and OS files. It uses SHA-1 to generate a known set of digital signatures called the Reference Data Set (RDS).
6. RDS can be used to filter known information. You can also use the RDS to locate and identify known bad files.

Using Validation Protocols

1. It is important to verifying your results. For that, you must use at least two different tools. One tool is for retrieving and examining your evidence and the other tool is for verifying the results.
2. One way to compare results and verify a new tool is by using a disk editor, such as Hex Workshop or WinHex. Disk editors do not have a flashy interface, but are reliable tools and can be used to access raw data.
3. The steps involved in the computer forensics examination protocol, including:
  - Perform the investigation with a GUI tool
  - Verify your results with a disk editor
  - Compare hash values obtained with both tools
4. The steps involved in the computer forensics tool upgrade protocol, including:
  - Test new releases, OS patches, and upgrades
  - If you found a problem, report it to your forensics tool vendor. Do not use the forensics tool until the problem has been fixed
  - Use a test hard disk for validation purposes
  - Check the Web for new editions, updates, patches and validation tests for your tools