A Feature Comparison of Modern Digital Forensic Imaging Software

TL;DR

This paper surveys modern digital forensic imaging software, analyzing their features, development cycles, and identifying weaknesses to suggest improvements for the fundamental tools used in digital investigations.

Contribution

It provides a comprehensive feature comparison and analysis of current forensic imaging tools, highlighting development patterns and proposing enhancements.

Findings

Current tools show stagnation in feature development

Weaknesses in maintenance and updates of forensic software

Recommendations for improving tool development and sustainability

Abstract

Fundamental processes in digital forensic investigation, such as disk imaging, were developed when digital investigation was relatively young. As digital forensic processes and procedures matured, these fundamental tools, that are the pillars of the reset of the data processing and analysis phases of an investigation, largely stayed the same. This work is a study of modern digital forensic imaging software tools. Specifically, we will examine the feature sets of modern digital forensic imaging tools, as well as their development and release cycles to understand patterns of fundamental tool development. Based on this survey, we show the weakness in current digital investigation fundamental software development and maintenance over time. We also provide recommendations on how to improve fundamental tools.