october12,2001.docVIP

October 12, 2001 Disk Imaging Tool Specification Version 3.1.6 TABLE OF CONTENTS 1. INTRODUCTION 3 2. PURPOSE 3 3. SCOPE 3 4. GLOSSARY 3 5. REQUIREMENTS 4 5.1 Mandatory Requirements 4 5.2 Optional Requirements 5 6. ASSERTIONS 5 6.1 Mandatory Assertions 6 6.2 Optional Assertions 6 7. ABSTRACT TEST CASES 7 7.1 Test Parameters 7 7.2 Test Procedures 9 7.3 Test Cases 11 1. INTRODUCTION Accurate and dependable computer forensics tools are required for a reliable means of investigating crimes that involve computers. In order to insure a measure of reliability and assurance that the results are accurate, the tools used in these investigations should be tested. The Computer Forensics Tool Verification project at the National Institute of Standards and Technology (NIST), an agency of the United States Department of Commerce, provides a measure of confidence in the software tools used in computer forensics investigations. It provides law enforcement personnel with a means of deciding whether the tools in consideration for use should be applied to the purposes required. 2. PURPOSE This document defines requirements for disk imaging tools used in computer forensics investigations and the test methods used to ascertain whether a specific tool meets the requirements. The requirements are used to derive assertions that will be tested. The assertions are described as general statements of conditions that can be checked after a test is executed. Each assertion will have one or more test cases that specify detailed start parameters, procedures for executing a test, and expected results. The requirements and test methods were developed by a focus group of individuals who are expert in the use of disk imaging tools and have performed investigations that have depended on the results of these tools. As this document evolves through comments from the focus group and others, new versions will be posted to our web site at