Background
As digital forensic investigation methodologies have matured to accommodate the developments in technology,crime and investigative capabilities over the last 20 years,internal controls have been introduced to provide assurance standards required by the legal process. Within our expectations of assurance there are a relatively small set of acceptable and ‘trusted’ investigative tools. FTK and EnCase are two of the most popular and trusted tools for digital media forensics. We know from more than a decade of use that their design endows confidence in the investigative process, and this is supported by these tools being tested for forensic appropriateness by NIST. In particular, the risk of ‘mixing up data’ between the evidence media and the host computer is negligible. There is no realistic way that data from another image could be introduced because there is no mechanism, other than operator error working on the wrong image, for this to happen. Provided the investigator is trained to use these applications as they were intended, the system is inherently assured. The designers consciously choose not to have a write-ability, not because it’s just easier that way but because we have a special need to protect the data under investigation.