Federated Testing Version 3.0 for Disk Imaging, Mobile Forensics Data Extraction and Hardware Write Blocking is now Available!
The Federated Testing project is an expansion of the Computer Forensics Tool Testing (CFTT) Program to provide digital forensics investigators and labs with test materials for tool testing and to support shared test reports. The goal of Federated Testing is to help digital forensics investigators to test the tools that they use in their labs and to enable sharing of tool test results within the digital forensics community.
Shared Test Materials
CFTT has developed test materials that will help you test your forensic tool. The test materials take the form of a live Linux CD .iso file.
To test your tool using the Federated Testing materials:
- Download the .iso file for the latest version of the materials (see the Downloads section below) and burn the .iso file to a blank CD.
- Insert the CD into your forensic workstation and boot to it (you may need to change your computer's boot options to select your CD drive as your boot device).
- Use the CD's user interface (Firefox Web browser) to select the type of tool you want to test. The user interface will tell you what items you will need to have on hand to get started.
- Use the interface to generate the test cases for testing your tool and follow the instructions to run each test.
- Use the interface to generate a test report for your tool.
- Submit the test report and the log files created during testing to CFTT (if approved by your management) to share with the digital forensics community! See the Sharing Test Results section below for instructions on how to share your test results.
CFTT's approach to tool testing is to test a tool based on the functionalities it supports. Currently, you can use the Federated Testing CD to test disk imaging, mobile forensics data extraction and hardware write blocking tools, but CFTT will expand the materials in future releases to allow you to test more forensic functionalities and more types of tools, e.g., forensic media preparation (drive wiping), string search, etc.
Shared Test Reports
A primary goal of the Federated Testing project is to produce tool test results that can be shared throughout the digital forensics community. Our Federated Testing materials (packaged on our live Linux CD .iso file) allow any lab, agency or individual to test their tools using the same test methodology CFTT uses. The final step of this process is to generate a test report for the tool. Our materials generate that test report for you in a common format that makes it easy for you and others to understand how the tool was tested and what the test results are. If someone has already tested a tool for the features you use in your lab, you can take advantage of their results in your evaluation of the tool. Click on the links below for test reports including Federated Testing reports.
- Disk Imaging Tool Test Reports
- Mobile Device Tool Test Reports
- Hardware Write Block Tool Test Reports
Sharing Test Results
Email your test report produced using CFTT's Federated Testing materials and a zipped copy of the testing log files to email@example.com to share your results with the digital forensics community. CFTT staff will review your logs and the test results documented in the test report before sharing the test report with the community. Shared test reports from Federated Testing will be publicly available through this website.
Click here to download version 3.0 of CFTT's Federated Testing Forensic Tool Testing Environment (support for testing disk imaging, mobile forensics data extraction and hardware write blocking tools)!
ISO file sha1 value: 0367f721a54d617ae6cbf1bac799962d04bc6810
Email firstname.lastname@example.org with the word “subscribe” (without quotes) in the subject line to subscribe to the federatedtesting(at)nist.gov mailing list. Federatedtesting(at)nist.gov is a low volume mailing list for distributing updates on the Federated Testing project and the Federated Testing Forensic Tool Testing Environment (e.g., new releases/versions and capabilities).