Early forensic tools, like MACE and Norton, provided
basic recovery abilities, such as undelete and
unformat. Most investigations were on a single
workstation that was used by one individual. The
open-source, community-driven model that is used
today for digital forensic tool development makes tool
evolution modular, extensible, robust and sustainable,
across various platforms. Software and standards
baselines provide a foundation that focuses on
extensions, plug-ins and digital evidence bag (DEB)
metaformat for development.