Use of forensic corpora in validation of data carving on solid-state drives.

Abstract

The need for greater focus on the validation and verification of tools has become more evident in recent years. The research in this area has been minimal. Continued research regarding the validation of digital forensics tools is necessary to help meet demands from both the law enforcement and scientific communities and to bring digital forensics in line with other forensic disciplines (as cited in Guo, et al., 2009). One of the most effective ways to perform validation and verification of digital forensics tools is to enlist the use of standardized data sets, also known as forensic corpora. This study focused on the use of forensic corpora to validate the file carving function of a common digital forensics tool, Access Data's Forensic Tool Kit (FTK). The study centers specifically on FTK's ability to recover data on solid-state drives (SSDs). The goal of this study was to both evaluate the use of forensic corpora in the validation and verification of digital forensic tools, as well as a serve as a validation study of FTK's carving function on solid-state drives.