# Forensic Investigation of Remnant Data on USB Storage Devices Sold in New Zealand
## 3 Experimental Evaluation
### Experimental Phases  
This study involves five concrete steps, as shown in Figure 2, described below:  
1. Selecting the forensic imaging tools, and tool function requirements based on the study of relevant articles (e.g., conference papers, journals, and reports) and the information gathered from other sources. An overview of the evaluation of forensic imaging tools is provided in this research. The authors [43] suggested the method of linking relevant functional requirements to each suitable test case. This method created an abstract level to identify the necessary functions for researchers, software developers, companies, and other users wishing to evaluate these forensic tools. CFTT specified the mandatory and optional tool functions for the forensic imaging tool, so all the function requirements used in this research were adapted from NIST (2004) \begin{table}
\begin{tabular}{c c c} \hline \hline
**Categories** & **USB Storage** & **USB Drive ID** \\ \hline \multirow{5}{*}{**Small** (40 to 160 GB)} & 40 GB & USB-HD-01 \\ \cline{2-3}  & 120 GB & USB-HD-06 \\ \cline{2-3}  & 160 GB & USB-HD-12 \\ \cline{2-3}  & 250 GB & USB-HD-05 \\ \cline{2-3}  & 320 GB & USB-HD-08 \\ \hline \multirow{5}{*}{**Medium** (160 to 350 GB)} & 40 GB & USB-HD-03 \\ \cline{2-3}  & 500 GB & USB-HD-04 \\ \cline{2-3}  & 500 GB & USB-HD-11 \\ \cline{2-3}  & 500 GB & USB-HD-13 \\ \cline{2-3}  & 640 GB & USB-HD-02 \\ \hline \multirow{5}{*}{**Extra-Large** (650 to 100 GB)} & 750 GB & USB-HD-09 \\ \cline{2-3}  & 1000 GB & USB-HD-17 \\ \cline{1-1} \cline{2-3}  & Total & 17 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Second-hand USB external hard drives used for tool evaluation experiment (dUSB-HD means USB hard drive). and NIST (2005), as presented in Appendix A. The complete list of test cases, which includes relevant test function requirements, can be read in Section 3.3.2. 2. Involves setting up a testing environment in the laboratory with the acquired USB storage devices, which were forensically imaged using different open-source forensic imaging tools (i.e., DC3 DD, DCFLDD, and Guymager). Beforehand, the USBs were connected to the forensic work station, and the USB devices were read through the write-blocker device to ensure the integrity of the original data during the imaging process. Data were collected from the experiments, following, categorised based on the test cases. 3. Performing experiments to evaluate and compare the performance and functionality of forensic imaging tools based on the test cases and tool functions requirements. 4. Retrieving the data by using the forensic images created in Phase 2. All the collected data from forensic images of USB storage devices were analysed and categorised based on the file formats. Finally, the research findings were comprehensively discussed. In Phase 2, a series of tests, developed in Phase 1, were performed based on the test cases. Four test cases were created to test the tool functionalities in four aspects, i.e., accuracy, completeness, completion speed, and hardware usage. By using the same test case on different USB external hard drives to evaluate these tools, the collected data could present the tool's functionality, hardware usage, and time consumption among different storage capacities. After the data were collected, a comparison table and graph were created showing the performance and tool's functionality of the selected tools. All the forensic images created in Phase 2 were used in Phase 4 to collect all the remnant data in the USB external hard drive via the Autopsy tool (a forensic analysis tool). The tool categorised all recovered files from the forensic images according to their file format. The procedure to experiment can be listed in these steps as follows:  
* Step 1: Setup and configured the forensic work station with the selected forensic tools on the suitable operating system. * Step 2: Experiment with the selected tools and evaluate their functionalities based on the created test cases.