Commentary:- Can I use that tool?

Abstract

The decision as to whether a given tool can be used for the purposes of conducting a digital forensic examination of a device and its data may seem straightforward, but it is not. As part of their work, practitioners must always seek to identify and use tools that are appropriate for their investigative tasks, deploy them reliably within an applicable scenario, and be able to trust and understand the results that they provide. Before they can begin to do this, they must first ask themselves the question - ‘can I use that tool?‘, where this work considers how a practitioner may begin to formulate an answer. By unpacking the hidden complexity of this question, it is suggested that five sub-questions must be explored by any practitioner when seeking to use a tool, namely - (1) ‘what does that tool do?‘; (2) ‘how do I use that tool?‘; (3) ‘how does the tool do it?‘; (4) ‘does the tool do it properly?’ and (5) ‘should I use the tool?‘. This work discusses each in turn and the risks they pose to a practitioner.