Keywords

1 Introduction

Modern digital forensics deliver reliable computer analysis and digital evidence collecting for a wide range of applications in law and industry. As a result, prototype implementations are commonly included in research projects. For example, look at the DJI Phantom III Drone [1]. The findings on the patented encrypted file format were reported in their research work in which a reference manager to automate the process was also included. Although digital storage media (such as a USB memory stick or a hard disc drive) may be physically and visually examined, the data stored on these devices can only be analysed using specialised equipment and software capable of deciphering and displaying it understandably. While microscopic technologies may allow for manual data analysis on specific device types at a sector level, it is not practical to investigate media in this manner in most cases. And, when it comes to accurately interpreting and presenting digital evidence, forensic investigators rely on the digital software tools they use for the investigation [2].

In private, digital forensic techniques are frequently used to find a piece of evidence that can be utilised in court, reverse engineering of computer systems, data recovery, maintenance and troubleshooting [3]. Online digital forensics can be used by any user who has a clear idea about their needs. Specific tools are created for this exact reason, helping one choose which software would best solve one’s requirement. Additionally, the creation of digital forensic competitions encourages tool development, with the Digital Forensics Research Workshop (DFRWS) challenges being a notable example. The DFRWS conferences have been challenging scholars and practitioners since 2005 to push the state of the art in developing forensic tools [4].

1.1 Introduction to Cyber Crimes

When dealing with a cybercrime scene, it is critical to pay close attention to digital evidence as the crime scene evidence is presented in an electronic form, which significantly distinguishes cybercrime from traditional crime. Further, it facilitates the criminal to store, hide, spread and delete information, making arresting cybercrime suspects more difficult [5].

According to [6], cybercrime covers the following:

  1. 1.

    Intellectual property theft

  2. 2.

    Damaging of service networks of a company

  3. 3.

    Financial fraud

  4. 4.

    The intrusion of hackers system

  5. 5.

    Distribution of execution virus and worms

Cybercrime can be split into three comprises or “3Ts” [7]:

  1. i.

    Tools to commit a crime

  2. ii.

    Targets of the crime (Victim)

  3. iii.

    Material that is tangential to the crime

To detect and find evidence against a cybercrime, digital forensic can be used. Wang and his team devised a strategy of leveraging forensic toolkits to aid the collecting of robust digital evidence in order to keep the compelling clues from computer-based systems. As a result, vital tracks left at a cybercrime scene can be used to convict the perpetrators. To raise awareness of cybercrime, researches created a Web forensic framework based on four different sorts of patterns that provide them with proof of harmful Bot activity on Web services [8].

1.2 Introduction to Tools

Tools are not only made for a specific purpose but also for general use [9]. However, Lexico defines a tool as a device or implementation that is used to perform a specific function [10]. They have also been described as a self-contained tool and provide a particular amount of automation, i.e. user intervention is minimal, reduced and abstracted. For example, a tool should not need the user to determine sector numbers or translate virtual to physical addresses manually to access the disc. Individuals or research groups frequently create and use forensic tools in any computer language of their choice. Also, if a tool is automated, it can be employed in other programmes. Various forensic tools support us in obtaining the disc images and automating much of the analysis process as well, such as:

  1. I.

    File fragments, hidden and deleted files and directories can be identified and recovered from any location

  2. II.

    The file structure, headers and other aspects determine directly the kind of data each file contains

  3. III.

    All the contents of the graphic files can be displayed

  4. IV.

    Advanced searches can be conducted

  5. V.

    Can exhibit the directory structure of the drive acquired graphically

  6. VI.

    And producing the reports

The Autopsy tool, an upgraded version from the sleuth kit forensic tools with some add-ons, is used in the fields of law enforcement, military, corporate examination, recovery, data backup, training and in some commercial areas with restriction included or with the limited privileges over the problems. Wireshark is a packet sniffer and analyser and records on the local network all the network traffic and saves it for later study. The Metasploit framework is a forensic tool that may be used by both cybercriminals and ethical hackers to investigate network and server vulnerabilities. Nessus is a remote complete security scanning programme that checks for security flaws on a computer and informs you whether such vulnerabilities may potentially be exploited by malicious hackers to grant access to other networked computers. Nmap is a free network mapper that uses IP packets to search a network for live hosts, port scans, ping sweeps, OS detection and version detection. AccessData created FTK Imager, a data viewing and imaging application. Volatility is a memory forensics framework that is free (under the GPL licence) and can be used for incident response and malware investigation. Computer-aided investigate environment (CAINE) is a Linux distribution that provides a detailed forensic investigation and reporting environment, with a graphical user interface that is designed to let users examine, investigate and gather actionable findings. MAGNET RAM Record is an effective imaging technique because it allows investigators to extract and examine artefacts that usually only exist in local physical memory. Network Miner is a network forensics programme that utilises packet sniffing or a PCAP file to identify OS, sessions, hostname and open ports without putting any traffic on the network.

1.3 Motivation and Contributions

No research has been done on the diversity, availability or quality of the tools that have been published. As a result, this review work came up with the following study question: What factors influence the applicability and use of tools? To get an answer to this question, the research papers from a variety of digital forensics magazines and conferences and tools’ performance and applications have been studied. Tools were tested for availability, usability, deployment, GUI, error prevention and handling and API integration. Along with this, the current challenges in the area of forensic tool development have been discussed in the paper.

2 Methodology

In this review work, the research and review publications on digital forensic tools’ performance, applications and limitations were reviewed and analysed. The purpose of this investigation is to locate software mainly designed for research purposes, as well as to investigate any preceding work or other features of these tools. Figure 1 shows how the current work was written using the process of a detailed review. Cumulated research articles were reviewed explicitly, focusing on tools usability and limitations. Tools were tested on their performance features such as availability, deployment, GUI, error prevention and handling and API integration. Along with this, research articles were found where the application of any of these tools in digital forensic or any other field was proven. The result of the comparative study was separated and documented into two tables. With the help of these two tables, the various features of each tool, their application and their limitations are concluded.

Fig. 1
figure 1

Steps involved in the review

Full size image

3 Observations

After segregating the tool-specific research articles, the software tool’s performance was tested depending on various key features. It is essential for a tool to be deployed so as to create a collaborative environment. This would make it easy for everyone to see all of the outcomes in near real time. Hence, there’s no need to integrate the results anymore, and a single, unified report may be generated at any moment [11]. Autopsy provides the best collaborative environment. GUI is by far the most popular means used to interact with software today [12]. As it enables increased productivity, while also reducing cognitive stress. It is critical to effectively prevent and handle errors in requirements analysis and design to improve software productivity and reliability [13]. Since many software are developed to support a wide range of applications. It is critical for software tools to rely on the implementation of mature application programming interfaces (APIs) to facilitate the growth of software for artificial intelligence of things (AIoT) [14] (Table 1).

Table 1 Performance analysis of tools
Full size table

This research work also highlights the various applications in which these forensic tools were used. Table 2 gives the observations made by authors while they were using these software tools for their requirements. The various fields in which these tools are incorporated prove that the digital forensics community has a strong application orientation, which means we solve problems in practice rather than a theory. After reviewing the works, we have tabulated the application, conclusion and limitations of tools observed by the authors.

Table 2 Application analysis of tools
Full size table

3.1 Limitations Observed

To be admissible in court, digital forensics must follow a specific collection, analysis and reporting process. Despite the expanding use of electronic forensics to help out in criminal cases and the necessity for practical tools, NIST’s forensic tool testing programme remains the only one available. Also, digital forensic tools have no international standard.

The lack of support, documentation, updates and the software’s safety are all risks associated with using free tools/software. Tools used in the research were either poorly documented or not documented at all. The study highlights the poor user interface and developers’ disinterest. Despite publication, it has been discovered that most tools were only used in cited works (2014) [25]. When limited test data is provided, or only specific tool versions or single picture format is inputted, the NIST tool testing requirements are “narrowly specified” [26]. There is also a lack of testing methods to analyse the tool reliability that exist for established technologies as well.

Because no single digital forensics tool can do everything due to the ongoing evolution of the field, researchers frequently build solutions to fill in the gaps left by existing tools. It is difficult to quantify how research has affected the real world since most of the study is academic-focused. This also leads to a trade-off between academic and field interests. Authors point out how digital forensic is applicable in various areas, and as a result, collaboration and transparency are required, possibly through programmes that distribute research-based tools to industrial participants who would not otherwise contact with academia [27].

A tool is primarily built based on the developer’s individual demands and preferred language. The tool is not thoroughly tested or documented due to lack of robustness and maintainability. Insecure coding compromises security, dependability, flexibility and scalability. No technologies exist to extract IoT traces from mobile devices. Collecting and analysing IoT memory is also difficult. Bluetooth, Zigbee and Z-Wave forensics tools must be added.

4 Conclusions and Future Work

Due to the fact that the vast majority of transactions and communication in today’s world takes place online, digital security has become increasingly important. The demand for forensic-based approaches and tools has also skyrocketed as a result of this. Accurate computer analysis and digital evidence collection are required for various legal and commercial applications, and digital forensics technologies are critical in this regard. This review work provides a comparison of a number of free source digital forensic tools, which anyone can use depending on their requirements. In this comparison, the tools are evaluated on a variety of criteria, allowing users to choose the tool that best meets their needs and, as a result, provided superior forensic visualisation. Various performance features along with applications of these ten tools are tabulated. The work also discusses the limitations for forensic tools like reliability, usability, maintainability and the need of integrating IoT. These observations can be utilised to develop software that meets the needs of digital forensics professionals. The advancement of these forensic techniques will significantly aid in the discovery of digital evidence.

It is proposed to extend this comparison study of digital forensic tools on various other factors and across other forensic tools, which will give a better insight into these tools. It can further work to provide a set of guidelines for designing digital forensics tools.