liu.seSearch for publications in DiVA
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • harvard1
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • oxford
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
A systematic evaluation of disk imaging in EnCase® 6.8 and LinEn 6.1
Linköping University, The Institute of Technology. Linköping University, Department of Computer and Information Science, Database and information techniques.
Linköping University, Department of Computer and Information Science, Database and information techniques. Linköping University, The Institute of Technology.
2009 (English)In: Digital Investigation, ISSN 1742-2876, Vol. 6, no 1-2, 61-70 p.Article in journal (Refereed) Published
Abstract [en]

Tools for disk imaging (or more generally speaking, digital acquisition) are a foundation for forensic examination of digital evidence. Therefore it is crucial that such tools work as expected. The only way to determine whether this is the case or not is through systematic testing of each tool. In this paper we present such an evaluation of the disk imaging functions of EnCase 6.8® and LinEn 6.1, conducted on behalf of the Swedish National Laboratory of Forensic Science. Although both tools performed as expected under most circumstances, we identified cases where flaws that can lead to inaccurate and incomplete acquisition results in LinEn 6.1 were exposed. We have also identified limitations in the tool that were not evident from its documentation. In addition summarizing the test results, we present our testing methodology, which has novel elements that we think can benefit other evaluation projects.

Place, publisher, year, edition, pages
2009. Vol. 6, no 1-2, 61-70 p.
Keyword [en]
Acquisition of digital data; EnCase®; Hard drive imaging; LinEn; Linux; Testing forensic tools
National Category
Engineering and Technology
Identifiers
URN: urn:nbn:se:liu:diva-21237DOI: 10.1016/j.diin.2009.05.004OAI: oai:DiVA.org:liu-21237DiVA: diva2:240985
Available from: 2009-09-30 Created: 2009-09-30 Last updated: 2014-06-24

Open Access in DiVA

No full text

Other links

Publisher's full text

Authority records BETA

Byers, DavidShahmehri, Nahid

Search in DiVA

By author/editor
Byers, DavidShahmehri, Nahid
By organisation
The Institute of TechnologyDatabase and information techniques
Engineering and Technology

Search outside of DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetric score

doi
urn-nbn
Total: 146 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • harvard1
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • oxford
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf