Pypette: A Framework for the Automated Evaluation of Live Digital Forensic Techniques

With the increasing scale of digital forensic investigations, there is a need for approaches that are capable of reducing the quantities of data forensic examiners are required to search. Meanwhile, as anti-forensic and encryption techniques evolve, there is an increasing need to capture relevant information from a machine before powering it off. Numerous approaches to live forensic evidence acquisition have been proposed in the literature, but relatively little attention has been paid to the problem of identifying how the effects of these tools, and their improvements over other techniques, can be evaluated and quantified. In this paper we present a framework for the automated evaluation of live digital forensic acquisition tools on a variety of platform configurations.