Designing and Validating an Evaluation Digital Forensic for Selective Seizure Capabilities in Windows Forensic Tools

1. Introduction

In digital forensics, search and seizure procedures typically involve the copying or printing of digital data, except physical storage media [1]. Despite the importance of selective seizures in investigations, research on the tools used during the process is lacking. Investigative agencies use forensic tools to search and seize storage media, and their legal admissibility depends on the ability of such tools to reliably perform selective seizures. However, digital forensic tools with selective seizure functions are yet to be developed, resulting in the insufficient implementation of relevant functionalities. An effective selective seizure function should offer the capability to extract and seize only digital information relevant to criminal suspicion, thereby minimizing unnecessary information, protecting privacy and human rights, ensuring compliance with laws, and enabling investigations that meet the required standards. This study identifies selective seizure functions, six digital forensic tools are selected, and a model to evaluate the functions is designed. Based on the model, a dataset is generated to test the capabilities of each tool. The evaluation criteria are designed based on the requirements for digital-forensic-tool verification from prior research, such as “NIST CFTT verification items and domestic TTA standardization documents.” The experimental environment is deployed in Windows 10, which features a high domestic market share of 77.9% [2], and tools registered with the National Institute of Standards and Technology (NIST) are employed to support the portable, graphical user interface (GUI)-based system for the New Technology File System (NTFS) [3]. Specifically, we aim to evaluate the efficiency and practicality of digital forensic tools by simulating their actual execution in the field. To evaluate the selected tools, a dataset is developed for tests over three phases—search, select, and seizure—used to design the evaluation model. In the search phase, the file system information and Windows-log analysis related to file timestamps are considered to mirror actual field conditions, whereas messenger, cloud, remote program, and virtual environment analyses are excluded.

In the selection phase, tools are selected based on their ability to filter and search necessary files, excluding unallocated areas and slack space. The seizure phase focuses on selecting logical images using file-level collection functions, additional physical images, and memory-acquisition functions. The experiment is designed to consider the environment and systems employed for actual selective seizures in the field. The experimental setup for evaluating the functions of Windows forensic tools employs two laptops running Windows 10 in a VMware Workstation Pro virtual environment to simulate active system conditions [4]. The selected digital forensic tools are run in a portable format to evaluate their performance.

The remainder of this paper is organized as follows: Section II analyzes related work from both domestic and international sources on the concept and characteristics of digital evidence, legislative developments in criminal procedure law, and search and seizure procedures, including selective seizures. Additionally, the challenges and limitations associated with selective seizures of digital evidence are discussed. Section III presents the design of the proposed evaluation model for investigating selective seizure tools. A dataset is developed for evaluation and the experimental limitations are discussed. Section IV describes the experiment conducted using the designed evaluation dataset, and verifies whether the six tools support the analytical functions required in the evaluation model. Accordingly, recommendations on the use of tools depending on the type of crime are provided. Finally, Section V discusses the possible applications of the developed dataset and model, concludes the study, and presents future research directions.

Furthermore, with the increasing adoption of cloud computing and artificial intelligence technologies, digital forensics is evolving to address new challenges. Cloud forensics presents unique challenges in terms of data collection and analysis due to the distributed nature of cloud storage and the dynamic allocation of resources.[5,6] Recent advancements in AI-powered forensic tools have shown promise in automating the analysis of large-scale cloud environments,[7] enabling more efficient detection of relevant evidence across distributed systems. These tools can assist investigators in identifying patterns and relationships in cloud-stored data that might be difficult to discover through traditional methods. However, the integration of AI and cloud forensics also raises new considerations regarding data privacy, jurisdiction, and the validation of AI-assisted findings.

2. Related Work

Yoon and Lee [8] developed a system for the automated collection of crime-specific data from crime scenes and organized them by crime type. They presented an objective and standardized evidence-collection method and analysis guidelines independent of investigators’ skills. They further developed an initial response method for field use. Cho[9] found that in a Windows file system, deleting a directory also deleted the files within it. When a file is deleted, the timestamps for writing, master file table (MFT) modification, and access time in the $Standard Information attribute change simultaneously, whereas the three creation times remain unchanged. Shin[10] examined the email search and seizure process employed at a crime scene and developed an effective tool for the detailed analysis of email attachments based on field conditions. Methods to efficiently conduct searches and seizures have been proposed, suggesting the requirement for field tools tailored to file characteristics, rather than focusing solely on the importance of post-search acquisition. Lee and Shim[11] reviewed general verification procedures for digital forensic tools and conducted performance evaluations using proposed verification items and functional requirements. Their findings revealed fragmented file recovery, file-type recognition, and the handling of Korean strings as areas requiring improvements. Hama and James[12] compared the characteristics, development release cycles, and development patterns of digital forensic imaging tools, and proposed methods to address maintenance vulnerabilities. Park et al.[13] proposed verification scenarios and datasets for partition-recovery tools and established the dependency of tool performance on their ability to recover data from damaged storage media. Quick and Choo[14] emphasized the storage of a plethora of personal information on digital devices. Based on advancements in digital forensic technologies, they proposed standard procedures aligned with legal frameworks to resolve conflicts between investigations and safeguard human rights. Digital forensic imaging techniques were applied to big data and an approach for selecting key files and data such as registries, emails, documents, spreadsheets, Internet history, communications, log files, photos, and videos for imaging was developed. The data volume of the original media was successfully reduced by 100 times. Furthermore, the method was applied to cases from the Australian Law Enforcement Agency, and the possibility of further data volume reduction was established, demonstrating the applicability of data reduction techniques for the selective seizure of digital forensic data. Kim et al.[15] proposed a dataset for verifying Windows forensic tools by classifying Windows artifacts into two categories: time-related and behavior-based artifacts, as test requirements for digital forensic tool verification. Lee[16] designed a software quality evaluation model based on the ISO/IEC 9126 standard and evaluated the reliability, usability, efficiency, maintainability, and portability of digital forensic tools.

Internationally, the U.S. NIST, a federal agency in the Department of Commerce, tests the functionality, reliability, and consistency of digital forensic tools to provide tool verification information to law enforcement agencies, investigative bodies, and corporate security professionals. Particularly, the CFReDS project provides datasets for testing digital forensic tools to enhance digital evidence analysis capabilities.[17] Additionally, the Digital Forensic Research Workshop (DFRWS) has researched digital forensic tools and techniques to conduct standardization studies.[18] Contrarily, Forensic Focus reviews forensic tools, conducts webinars, and hosts forums, thereby providing information related to cybercrime investigations. However, previous studies have either been conducted on Windows 10 or older versions or have not experimentally evaluated and verified digital forensic tools for selective seizures that can be deployed in the latest operating systems. Therefore, this experimental study is designed to reflect tool verification requirements according to recent changes in the technological environment. The selected evaluation items are categorized into individual test cases and tested in an environment that simulates selective seizure procedures.

3. Evaluation Model and Data Set Development

3.1. Evaluation Model Disign

Various institutions worldwide produce numerous forensic images annually to compare and verify the proficiency and performance of various forensic tools.[19,20] However, the existing image analysis method has certain limitations; although the method is suitable for analyzing seized media, it is inadequate for selective seizure analysis. Moreover, the method is static, whereas actual seizures in the field require dynamic image analysis because the operating system actively runs and imposes various restrictions such as the need for file-access permissions. Domestic forensic societies, universities, and other institutions have developed and used various datasets for digital forensic tool verification and expert qualifications.[21,22,23] However, to test tools for domestic environments, an analytical method that reflects the requirements of field investigations, rather than relying solely on media seizures, is required.[24,25,26] Additionally, an environment that allows the testing of additional tools in the future is desirable.[27,28] Instead of using an evaluation method based on image files, a dataset that can be tested in an actual field environment is crucial.[29,30] Furthermore, an evaluation model to test the functions of forensic tools is essential for ensuring technical accuracy and legal validity.[31,32]] The tests should be conducted in accordance with the standards established by government agencies, academic research institutions, and international standardization organizations.[33,34,35] Table 1 presents image formats used in the test datasets by institutions and prior studies.

Existing requirements for verification covered in prior research were collected and compiled by borrowing the requirements required for the digital forensic tool evaluation model, and the digital forensic requirements are as follows: 1) file system verification requirements 2) file search verification requirements 3) file time related source log analysis verification requirements 4) application analysis verification requirements 5) data deletion and hidden verification requirements 6) verification and report requirements were used as evaluation indicators for verifying digital forensic analysis tools. [Table 2, Table 3, Table 4, Table 5 and Table 6]

This verification design method is the result of a digital forensic field response tool evaluation model design study not covered in prior research.

Previous studies have established evaluation content for digital forensic tools, and the requirements for selective seizure tools have been reflected in their designs. The requirements include:

Tools must be portable, field-ready, feature a GUI, and easy to use.

Tools must include functions for collecting case-relevant files in the field.

Tools must be able to analyze various logs.

Tools should support result verification and reporting.

During selective seizures, the Windows file system should be searched and the generated evidence must be verified. Once the search is complete, the Windows log information should be searched for files of interest, and those related to criminal allegations have to be identified. Finally, relevant files must be collected, and a report should be generated. Accordingly, an evaluation model for the Windows forensic selective seizure tool was designed for this study, as shown in Figure 1.

The digital forensic process involves the following steps: 1. investigation preparation; 2. evidence acquisition, 3. transportation and storage, 4. investigation and analysis; and 5. report generation. In this study, a new evaluation model was developed for window-based selective seizure tools that consider field-response criteria. To ensure comprehensive testing, detailed evidence image files representing diverse application environments were created. File integrity was verified to ensure that the content did not change after the analysis, considering the characteristics of the target tools. The evaluation involved comparing the analysis functions of the selected seizure tools across the three main phases and eight items, as listed in Table 7.

3.2. Evaluation Model Disign

Various institutions worldwide produce numerous forensic images annually to compare and verify the proficiency and performance of various forensic tools.[19,20] However, the existing image analysis method has certain limitations; although the method is suitable for analyzing seized media, it is inadequate for selective seizure analysis.　Selective seizure in digital forensic investigations requires not only functional support from forensic tools but also a systematic method for evaluating whether such tools adequately satisfy procedural, technical, and legal requirements. To address this need, this study formalizes the evaluation of selective seizure functions through a phase-based analytical model supported by quantitative expressions. The proposed evaluation model is structured according to the three procedural phases commonly observed in field investigations: search, selection, and seizure. Each phase reflects a distinct investigative objective—identifying relevant artifacts, narrowing the scope of evidence, and securely collecting admissible digital evidence. Rather than treating selective seizure as a monolithic process, this phased structure allows the functional capabilities of forensic tools to be examined in alignment with actual investigative workflows，provides a narrative explanation of the rules applied for calculating the Selective Seizure Capability Index (SSI) and presents a step-by-step expansion of the calculation results for each evaluated Windows forensic tool.　First, the SSI calculation begins with symbol-based scoring. In the evaluation tables, each functional item is assessed using qualitative symbols. These symbols are systematically converted into numerical scores to enable quantitative analysis. Specifically, a symbol of O is assigned a score of 3, □ is assigned a score of 2, △ is assigned a score of 1, and – is assigned a score of 0. Accordingly, for each evaluation item i within an investigative phase p, the score of a tool T is defined as s_{p,i}(T) ∈ {3, 2, 1, 0}.　Second, phase-level raw scores are calculated. For each investigative phase—Search, Select, and Seizure—the raw score E_p(T) of a tool is obtained by summing the scores of all evaluation items belonging to that phase. Because the number of evaluation items differs across phases, raw scores alone cannot be compared directly.　Third, to ensure fairness across phases, each phase-level raw score is normalized. The normalization is performed by dividing the raw score by the maximum possible score for that phase, which is defined as three times the number of evaluation items. As a result, the normalized phase score ranges between 0 and 1, representing the proportion of functional requirements satisfied by the tool within that phase.　Fourth, the normalized phase scores are aggregated into a single SSI value through weighted summation. In this study, weights of 0.3 were assigned to the Search and Select phases, while a higher weight of 0.4 was assigned to the Seizure phase to reflect its direct relevance to evidentiary integrity and admissibility. The resulting SSI value therefore represents the overall degree to which a tool supports selective seizure procedures.For interpretation convenience, the final SSI values are also expressed as percentages by multiplying the normalized SSI by 100.　In this study, the number of evaluation items and corresponding maximum scores were fixed as follows: the Search phase consisted of 49 items with a maximum score of 147, the Select phase consisted of 80 items with a maximum score of 240, and the Seizure phase consisted of 10 symbol-based items with a maximum score of 30. Non-symbolic entries, such as time measurements or descriptive report formats, were excluded from the SSI calculation to maintain reproducibility.　Based on these rules, Tool A achieved a low SSI value, primarily due to minimal support in the Search and Select phases, despite moderate performance in the Seizure phase. Tool B demonstrated balanced performance across all phases, resulting in a moderate SSI. Tool C showed relatively strong performance in the Select and Seizure phases, which significantly contributed to its higher SSI. Tool D exhibited strong Search and Seizure capabilities but weaker Select-phase support, leading to a mid-range SSI value. Tool E achieved the highest SSI, reflecting consistently strong performance across all three phases, particularly in Search and Seizure functions. In contrast, Tool F showed limited Search and Select capabilities and relied mainly on Seizure-phase performance, resulting in a comparatively low SSI.　Overall, this narrative calculation process demonstrates that the SSI is not a simple ranking score but a structured and transparent index derived from phase-specific functional performance. By integrating normalization and weighted aggregation, the SSI enables reproducible, fair, and procedurally aligned evaluation of Windows forensic tools in selective seizure scenarios. The proposed evaluation model is structured according to the three procedural phases commonly observed in field investigations: search, selection, and seizure. Each phase reflects a distinct investigative objective—identifying relevant artifacts, narrowing the scope of evidence, and securely collecting admissible digital evidence. Rather than treating selective seizure as a monolithic process, this phased structure allows the functional capabilities of forensic tools to be examined in alignment with actual investigative workflows.　Let T denote a Windows-based forensic tool subject to evaluation, and let p ∈ {Search, Select, Seizure} represent an investigative phase. The evaluation score of tool T at phase p is defined as:

$E_{p\left(T\right)}={\sum }_{\left\{i=1\right\}}^{\left\{n_p\right\}}{s}_{\left\{p,i\right\}\left(T\right)}$where n_p is the number of evaluation items associated with phase p, and s_{p,i}(T) denotes the score assigned to the i-th evaluation item. This formulation enables a structured aggregation of tool capabilities within each procedural stage, ensuring that individual functional elements are assessed systematically rather than anecdotally.　To preserve the intuitive clarity of qualitative assessment while enabling quantitative comparison, this study maps the symbol-based evaluation scheme to a numerical scoring function. Specifically, the score s_{p,i}(T) is defined as follows:

s{p,i}(T) = 3, if the tool fully satisfies all verification criteria (O);s{p,i}(T) = 2, if three or more criteria are satisfied (□);s{p,i}(T) = 1, if criteria are partially satisfied with manual intervention (△);s{p,i}(T) = 0, if the criteria are not satisfied (-).

This mapping allows qualitative judgments to be expressed in a reproducible and transparent manner, thereby reducing subjectivity and enhancing analytical rigor. At the same time, the original symbolic representation is retained in result tables to maintain practical interpretability for forensic practitioners.　While phase-specific evaluation scores provide detailed insights into tool performance, selective seizure in practice requires an integrated assessment that reflects procedural priorities. Accordingly, this study introduces the Selective Seizure Capability Index (SSI) as a composite measure of overall tool suitability:

$SSI\left(T\right)={\sum }_{\left\{p\backslash inP\right\}}{w}_p\cdot E\_p\left(T\right)$where P = {Search, Select, Seizure} and w_p denotes the weight assigned to phase p, subject to the constraint that ∑_{p} w_p = 1. The weighting scheme allows the evaluation model to adapt to investigative contexts; for example, greater emphasis may be placed on the seizure phase due to its direct implications for evidentiary integrity and admissibility, while search and selection phases emphasize efficiency and proportionality.　By integrating phase-based evaluation, symbol-to-score formalization, and weighted aggregation, the proposed model establishes a coherent and extensible framework for assessing selective seizure capabilities in Windows forensic tools. This formalization not only enhances the reproducibility of comparative evaluations but also provides a methodological foundation for future extensions, such as usability metrics, automation levels, or cross-platform adaptations.　Moreover, the method is static, whereas actual seizures in the field require dynamic image analysis because the operating system actively runs and imposes various restrictions such as the need for file-access permissions. Domestic forensic societies, universities, and other institutions have developed and used various datasets for digital forensic tool verification and expert qualifications.[21,22,23] However, to test tools for domestic environments, an analytical method that reflects the requirements of field investigations, rather than relying solely on media seizures, is required.[24,25,26] Additionally, an environment that allows the testing of additional tools in the future is desirable.[27,28] Instead of using an evaluation method based on image files, a dataset that can be tested in an actual field environment is crucial.[29,30] Furthermore, an evaluation model to test the functions of forensic tools is essential for ensuring technical accuracy and legal validity.[31,32]] The tests should be conducted in accordance with the standards established by government agencies, academic research institutions, and international standardization organizations.[33,34,35] Table 8 presents Tools evaluated in this study.

To maintain objectivity and avoid bias toward specific products, the tool names were anonymized[44,45], and their version information was not included to ensure anonymity. However, the latest version, as of November 30, 2023, was used. Anonymization ensured that the focus remained on the evaluation results and comparative analysis of tool functions rather than on a particular product. The evaluation results were expressed using four symbols, as listed in Table 9, with the recommended tools labeled Recommendation 1 (Tool Name*)” and Recommendation 2 (Tool Name**).

3.3. Dataset Development

To simulate a typical investigative scenario, the experimental environment for evaluating selective seizure functions comprised two standard laptops (Intel i5-1035G4 CPU, 8 GB RAM, and 250 GB SSD) instead of high-performance systems. The environment included a laptop with Windows 10 64-bit installed on a VMware virtual machine. Detailed specifications are listed in Table 10.

The method for evaluating selective seizure function comprised three phases: search, selection, and seizures. To minimize the number of steps required, the recovery phase was integrated into the file system and application analysis. Additionally, based on the previously described procedures, the evaluation components included NTFS analysis, Windows-log analysis, information searches, and collection/extraction. The parameters tested in the VMware virtual machine are listed in Table 11.

The information on the image files created in the VMware test environment included name, size, and hash information. The test environment was configured to generate the data necessary for evaluating the tool performance, including partition damage, file deletion, BitLocker configuration, and file timestamp information from Windows logs. A logical image comprising 200,000 files was created to test the selective seizure performances of the tools. The details of the virtual machine disk (VMDK) dataset are presented in Table 12.

The test dataset used in the VMware environment was divided into three configurations: file-system and Windows-log analyses, file-search, and collection and extraction. Additionally, as numerous files and substantial Windows log information were used, along with processes such as installation, creation, and deletion, four test environments were constructed. Each of the six tools was evaluated once, and the VMware snapshot functionality was used to ensure a consistent evaluation of the results. The experimental procedure, as illustrated in Figure 2, was implemented in the VMware environment on a laptop using a custom evaluation dataset that was saved as a VMDK image file for reuse.

The dataset employed to evaluate selective seizure functions enabled extensive testing of portable tools and yielded accurate results through four configurations of Windows functions. The dataset offered a key advantage of data from Koreans, thereby allowing tool verification for application to the domestic environment, supporting the Korean language.

4. Results and Discussion

4.1. Search Phase

4.1.1. NTFS Parsing

The NTFS parsing ability of the tools was tested across eight functions, as listed in Table 13. Tool C demonstrated the best performance, followed by Tool B. However, none of the tools met all requirements. For example, only Tool E recognized the BitLocker volume and supported key-input decryption, whereas Tool D supported the VBR (MBR) damage repair functionality. Additionally, Tools B and C supported the recovery of the deleted MFT (MBR) partitions. Tool B provided comprehensive support for analyzing $MFT entry headers, $Standard Information, $File Name, $Attribute, and $Date. Although Tool C met most evaluation requirements, Tool B proved valuable, as it provided substantial information concerning NTFS. The evaluation results listed in Table 13 indicated whether the tools accurately interpreted the file system and provided the necessary information.

4.1.2. File-and Folder-Access Log Analysis

We evaluated the tools’ ability to analyze file and folder-access logs across 10 evaluation items, as listed in Table 9. Tool E exhibited the best performance, followed by Tool D. In the link file analysis, Tool D provided comprehensive information, including the creation, modification, and access times for both the link and target files. However, Tool B provided some Korean file names as garbled characters, indicating unoptimized tool behavior for Korean and the requirement of a code page change function for proper display. Notably, only Tool E supported Windows.edb, $Logfile, and UsnJrnl, which contained critical information related to document and file activities, suggesting that the functionality of the other tools required improvements. Furthermore, analyzing folder-access logs was essential for confirming the evidence related to a case and tracing deleted information. The evaluation results, as listed in Table 14, indicated the importance of data activity analysis, which can be used to identify meaningful information and behaviors through prior investigations and evidence.

4.1.3. Application-Execution Log Analysis

The tools’ ability to analyze application-execution logs focused on four key areas, as listed in Table 10. Tool E performed the best, followed by Tool D. The results indicated that all tools supported the prefetch analysis, but Tool D did not support the SRUMDB analysis. Starting with Windows 10, log checking for application compatibility in the Cache and DB information were added. Although the logs provided valuable forensic insight, our evaluation revealed that some tools required improvements. Specifically, Tool B required improvements in Gram-execution log analysis, and Tool D required improvements in SRUMDB analysis. The evaluation results, as presented in Table 15, indicated the capabilities of the tools for analyzing application-execution activities, which could be used to determine the time and order of frequently used applications, detect data deletion or anti-forensic activities, and analyze application-execution behaviors.

4.1.4. Data-Transmission Log Analysis

The tools’ ability to analyze data-transmission logs focused on six areas, as listed in Table 16. Tool C exhibited the best performance, followed by Tool E. However, Tool C necessitated manual analysis to verify the results, whereas Tool E enabled automatic analysis, offering greater usability. However, event logs related to external storage devices were not analyzed. Additionally, two tools supported the analysis of wired-network information, whereas two supported the analysis of the connection and disconnection records of external storage devices. In cases involving technology leaks, the history of the external storage device usage and network information required verification. Network information is categorized into wired and wireless, whereas external storage device information is analyzed using the registry, event logs, and Setup.API logs.

4.1.5. Internet Search Log Analysis

The tools’ ability to analyze Internet search logs was evaluated using 18 items across three browsers (Google Chrome, Microsoft Edge, and Naver Whale). The results are listed in Table 17, where Tool E performed the best, followed by Tool B. Additionally, only Tool E supported the Whale browser analysis, whereas both Tools D and E supported the password analysis of the Edge. As the information stored in browsers i saved in database (DB) format, the tools should support DB analysis. Additionally, cache and cookie information were not configured in dedicated modules, making the analysis results difficult to interpret; thus, functionality improvements in these areas were necessary. As web browsers store data on internet activities and the interests of users, they provide crucial information for criminal investigations.

4.1.6. Suspicious-Activity Log Analysis

The tools’ capability to analyze suspicious activity logs was tested across three EventLog items, as listed in Table 18. Evidently, Tool C performed the best, followed by Tools D and E, whereas the other tools did not support EventLog analysis. The logs recorded a wide range of information and were the key to forensic analysis. Therefore, the functionality of the tools for analyzing EventLogs required improvements. Tool C allowed manual analysis by installing an additional viewer; however, searching for the results required knowledge of the real log ID. Therefore, the ability to interpret EventLog analysis more easily required enhancement. Error and system-change information recorded in EventLogs were used for suspicious-activity analysis and could be vital for identifying specific issues or proving criminal allegations.

4.2. Search Phase

4.2.1. File-and Folder-Name Search

The tools’ capability to analyze file and folder-name searches involved three items, as listed in Table 19. Tool C performed the best, followed by Tool E. Additionally, although most tools supported file name searches, they did not support folder name searches. Therefore, folder names and regular-expression search functionalities required improvements. In the NTFS, information on all files and directories, including records and file names, is stored in the MFT. The MFT record contains the $FILE_NAME attribute where the file name is stored.

4.2.2. File-and Folder-Name Search

The evaluation of the tools’ capability to support keyword search involved 14 file extensions and five Korean word items, as listed in Table 15. Tool E performed the best, followed by Tool C. Additionally, Tool D supported the index search but not the keyword search, whereas Tools A and B detected only one and two keywords, respectively. Additionally, the functionality of the tools for analyzing Korean keywords and supporting a wider range of file extensions required improvements. A keyword search was crucial for efficiently finding important information within large datasets, accelerating the investigation, and quickly accessing evidence critical for solving the case.

Table 20. File and Folder-name Search Analysis Results.

No.	File Type	Tool
		A	B	C**	D	E*	F
1	cell	-	□	O	-	O	-
2	csv	-	O	O	-	O	-
3	doc	- 1 hit	- 2 hits	O	-	O	-
4	docx	- 1 hit	- 2 hits	O	-	O	-
5	hwp	-	O	O	-	O	-
6	hwpx	-	-	-	-	O	-
7	pdf	-	O	O	-	O	-
8	ppt	- 1 hit	O	O	-	O	-
9	pptx		□	O	-	O	-
10	rtf	- 1 hit	- 2 hits	-	-	O	-
11	show	-	□	-	-	O	-
12	txt	-	□	O	-	O	-
13	xls	-	O	O	-	O	-
14	xlsx	-	O	O	-	O	-

*; **.

Table 20. File and Folder-name Search Analysis Results.

No.	File Type	Tool
		A	B	C**	D	E*	F
1	cell	-	□	O	-	O	-
2	csv	-	O	O	-	O	-
3	doc	- 1 hit	- 2 hits	O	-	O	-
4	docx	- 1 hit	- 2 hits	O	-	O	-
5	hwp	-	O	O	-	O	-
6	hwpx	-	-	-	-	O	-
7	pdf	-	O	O	-	O	-
8	ppt	- 1 hit	O	O	-	O	-
9	pptx		□	O	-	O	-
10	rtf	- 1 hit	- 2 hits	-	-	O	-
11	show	-	□	-	-	O	-
12	txt	-	□	O	-	O	-
13	xls	-	O	O	-	O	-
14	xlsx	-	O	O	-	O	-

*; **.

4.2.3. File-Header Classification

The file header classification performances of the tools were tested across 14 file extensions (Table 21). Tools B and C performed the best, followed by Tool E. However, none of the tools could classify the header information of all files, and Tools B and C did not support the same extensions. Moreover, only one tool supported the csv and hwpx extensions. The experiment involved altering the primary document extensions used in South Korea. The results of the file-signature analysis revealed some false positives, wherein files with the same signature were classified as the same document type. Classifying files based solely on file-header signatures led to a higher false-positive rate; therefore, future improvements should include comparing byte sequences and format structures unique to each file to accurately determine its original extension. Because file extensions are simply names indicating the information they contain, proper signature interpretation was necessary for accurate file recognition.

4.2.4. File-Header Classification

The DRM file identification performance of the tools was tested across ten items, as listed in Table 22. Evidently, Tool E performed the best; however, the tool identified only five items, whereas the others could not identify one item. Before encrypted files are detected, identifying the DRM files is crucial using domestically implemented document security systems. Functionality improvements were required across all tools to enable custom signature analysis. DRM files help prevent the leakage of confidential data and intellectual property, and the evaluation results reflected the signature analysis employed for their identification and classification.

4.2.5. Encrypted File Identification

The encrypted file identification performance of the tools was tested across eight file extensions, as listed in Table 23. Tool E performed best, followed by Tool B. The experiment included five document types and three compressed files encrypted using standard encryption. The identification performance of the models varied depending on the encryption algorithm employed. Not all the encrypted files used in the experiment were identified. Tool E successfully identified all the encrypted document-type files. Additionally, only Tools B and E identified encrypted files that were likely to contain sensitive information.

Table 23. DRM File Identification Results.

No.	File Type	Tool
		A	B**	C	D	E*	F
1	doc	-	O	-	-	O	-
2	docx	-	O	O	-	O	-
3	hwp	-	-	-	-	O	-
4	ppt	-	-	-	-	O	-
5	pptx	-	O	O	-	O	-
6	7z	-	O	-	-	-	-
7	tar	-	-	-	-	-	-
8	zip	-	O	-	-	O	-

*; **.

Table 23. DRM File Identification Results.

No.	File Type	Tool
		A	B**	C	D	E*	F
1	doc	-	O	-	-	O	-
2	docx	-	O	O	-	O	-
3	hwp	-	-	-	-	O	-
4	ppt	-	-	-	-	O	-
5	pptx	-	O	O	-	O	-
6	7z	-	O	-	-	-	-
7	tar	-	-	-	-	-	-
8	zip	-	O	-	-	O	-

*; **.

Table 24. File-preview Evaluation Results.

No.	Evaluation Item	File Type	Tool
			A	B**	C*	D	E	F
1	Document Files	cell	-	-	O	-	-	-
2		csv	-	O	O	-	-	-
3		doc	-	O	O	-	-	-
4		docx	-	O	O	-	-	-
5		hwp	-	O	O	-	-	-
6		hwpx	-	-	-	-	-	-
7		pdf	-	O	O	-	-	-
8		ppt	-	O	O	-	-	-
9		pptx	-	O	O	-	-	-
10		rtf	-	O	O	-	-	-
11		show	-	O	O	-	-	-
12		txt	-	O	O	-	-	-
13		xls	-	O	O	O	-	-
14		xlsx	-	O	O	-	-	-
15	Compound Files	pst	-	O	O	O	O	-
16		ost	-	O	O	O	O	-
17		sqlite	-	O	-	-	O	-
18		db	-	O	-	-	O	-
19		7z	-	-	O	O	-	-
20		zip	-	-	O	O	-	-
21		Tar	-	-	O	O	-	-
22		egg	-	-	O	-	-	-
23		rar	-	-	O	O	-	-
24	Image Files (EXIF Support)	awd	-	-	O	-	O	-
25		psd	-	O	O	-	O	-
26		dwg	-	-	O	-	O	-
27		bmp	-	O	O exif	O exif	O	-
28		png	-	O exif	O exif	O exif	O exif	-
29		psp	-	-	O exif	O exif	-	-
30		jpeg	-	-	O exif	O exif	O exif	-
31		jpg	-	O exif	O exif	O exif	O exif	-

*; **.

Table 24. File-preview Evaluation Results.

No.	Evaluation Item	File Type	Tool
			A	B**	C*	D	E	F
1	Document Files	cell	-	-	O	-	-	-
2		csv	-	O	O	-	-	-
3		doc	-	O	O	-	-	-
4		docx	-	O	O	-	-	-
5		hwp	-	O	O	-	-	-
6		hwpx	-	-	-	-	-	-
7		pdf	-	O	O	-	-	-
8		ppt	-	O	O	-	-	-
9		pptx	-	O	O	-	-	-
10		rtf	-	O	O	-	-	-
11		show	-	O	O	-	-	-
12		txt	-	O	O	-	-	-
13		xls	-	O	O	O	-	-
14		xlsx	-	O	O	-	-	-
15	Compound Files	pst	-	O	O	O	O	-
16		ost	-	O	O	O	O	-
17		sqlite	-	O	-	-	O	-
18		db	-	O	-	-	O	-
19		7z	-	-	O	O	-	-
20		zip	-	-	O	O	-	-
21		Tar	-	-	O	O	-	-
22		egg	-	-	O	-	-	-
23		rar	-	-	O	O	-	-
24	Image Files (EXIF Support)	awd	-	-	O	-	O	-
25		psd	-	O	O	-	O	-
26		dwg	-	-	O	-	O	-
27		bmp	-	O	O exif	O exif	O	-
28		png	-	O exif	O exif	O exif	O exif	-
29		psp	-	-	O exif	O exif	-	-
30		jpeg	-	-	O exif	O exif	O exif	-
31		jpg	-	O exif	O exif	O exif	O exif	-

*; **.

4.3. Seizure Phase

4.3.1. File-and Folder-Name Search

The collection and analysis performances of the tools were tested across seven evaluation items, as listed in Table 25. Tool E performed best, followed by Tool C. Based on the experimental results, logical image features exhibited different characteristics and formats for each tool. A key requirement for selective seizures is the ability to acquire logical images in a usable format and generate reports for the selected files; however, only Tool E offered this functionality. Tool D supported the VHD format, which enhanced its utility, but entailed a long acquisition time. The supported physical image format was E01 and there were no tool-supported memory-dump reports. Logical images focus on files and folders accessible to the user, allowing for the selective seizures of specific data. Additionally, they maintain the file system structure when copying data, thereby increasing their accessibility for analysis. Furthermore, to effectively handle exceptional cases, forensic tools must support memory dumps, physical image acquisition, and report generation.

4.3.2. Extraction Evaluation

The extraction functionality of the tools was tested across the five items listed in Table 26. Tool E performed the best, followed by Tool B. All the tools supported report generation, with HTML being the most commonly supported format. In addition, all except one tool supported hash generation and hash sets. To complete the electronic evidence verification form, selective seizure tools must support these functions.

4.4. SSI Evaluation

It provides a comprehensive narrative explanation of how the Selective Seizure　Capability Index was calculated in this study and why the SSI is a critical indicator for evaluating digital forensic tools in selective seizure scenarios. First, the SSI was designed to transform qualitative evaluation results into a reproducible and quantitative metric. In the experimental tables, each forensic tool was assessed using symbolic indicators　O, □, △, and which represent different levels of functional support. To enable mathematical aggregation, these symbols were converted into numerical scores O corresponds to 3 points, □ to 2 points, △ to 1 point, and – to 0 points. This conversion establishes a consistent numerical basis while preserving the original qualitative meaning of the evaluation. Next, the evaluation was conducted separately for each investigative phase: Search, Select, and Seizure. Within each phase, multiple evaluation items were defined. For a given tool, the scores assigned to all items within a phase were summed to obtain the raw phase score. However, because the number of evaluation items differs across phases, direct comparison of raw scores would be inappropriate. Therefore, each phase score was normalized by dividing it by the maximum possible score for that phase, calculated as three times the number of evaluation items. This normalization process ensures that all phase scores fall within a 0–1 range and are directly comparable. After normalization, the phase scores were aggregated into a single SSI value using a weighted summation. In this study, weights of 0.3 were assigned to both the Search and Select phases, while a higher weight of 0.4 was assigned to the Seizure phase. This weighting scheme reflects the procedural importance of evidence acquisition, integrity verification, and reporting in determining evidentiary admissibility. The resulting SSI value therefore represents the overall degree to which a forensic tool supports selective seizure procedures across all investigative phases. Finally, for ease of interpretation, the SSI values were expressed as percentages by multiplying the normalized SSI by 100. For example, an SSI value of 0.71 indicates that the tool satisfies approximately 71% of the ideal selective seizure requirements defined by the evaluation model. The SSI is important for several reasons. First, it consolidates a large number of heterogeneous evaluation items into a single, interpretable indicator, enabling direct comparison between forensic tools. Second, it aligns tool evaluation with the procedural workflow of selective seizure, ensuring that performance is assessed in a manner consistent with real-world investigative practice. Third, the weighted structure of the SSI allows the evaluation to be adapted to different investigative priorities, such as emphasizing rapid on-site analysis or strict evidentiary admissibility. Finally, by providing a transparent and reproducible calculation process, the SSI enhances the objectivity and credibility of tool evaluation results, supporting both academic analysis and practical decision-making in digital forensic investigations. The Selective Seizure Capability Index provides substantial academic value in the performance evaluation of Windows forensic tools by advancing tool assessment from descriptive comparison to a structured, procedure-oriented evaluation methodology. Conventional studies on forensic tools often focus on the presence or absence of specific functions or on case-based effectiveness, which limits reproducibility and generalizability. In contrast, the SSI introduces a formalized mechanism for aggregating heterogeneous evaluation results into a coherent quantitative index, thereby strengthening methodological rigor.　A primary contribution of the SSI lies in its ability to ensure fairness and comparability across evaluation dimensions. By converting qualitative assessment symbols into numerical scores and normalizing phase-level performance by their maximum attainable values, the SSI mitigates bias arising from unequal numbers of evaluation items across investigative phases. This normalization enables balanced comparison of tools even when functional coverage differs substantially, which is a common challenge in forensic tool evaluation.　Moreover, the SSI explicitly aligns performance assessment with the procedural workflow of selective seizure, structured around the Search, Select, and Seizure phases. This phase-based aggregation reflects actual field investigation practices and distinguishes between analytical convenience and evidentiary completeness. As a result, tools are evaluated not merely on isolated technical features but on their capacity to support selective seizure as an integrated investigative procedure.　The weighted aggregation employed in the SSI further enhances its academic relevance by allowing the evaluation model to reflect procedural priorities and legal considerations. Assigning a higher weight to the seizure phase emphasizes functions directly related to evidentiary integrity, verification, and reporting, which are critical for legal admissibility. At the same time, the weighting scheme remains adaptable, enabling researchers and practitioners to adjust phase importance according to investigative context or　jurisdictional requirements without altering the underlying evaluation structure.　From a normative perspective, the SSI also enables the quantification of principles that are traditionally addressed only at a conceptual level, such as proportionality and minimal intrusion. Performance in the selection phase　directly influences the extent to which unnecessary data collection can be avoided. By incorporating these aspects into a measurable index, the SSI bridges the gap between legal and ethical objectives of selective seizure and the technical capabilities of forensic tools. Importantly, the SSI should not be interpreted solely as a ranking metric. Rather, it functions as an analytical framework that supports both comparative assessment and diagnostic interpretation. The decomposition of the SSI into phase-specific components allows researchers to identify strengths and limitations of tools at each procedural stage, facilitating targeted improvements and meaningful cross-study comparison. Consequently, the SSI establishes a reproducible and extensible foundation for future research on forensic tool verification and selective seizure evaluation in Windows-based environments

4.5. Discussion

This study proposed and applied an evaluation framework for selective seizure capabilities in Windows forensic tools, with a focus on live-response scenarios in investigative practice. While the framework provides a structured and practical basis for comparing forensic tools, several limitations should be acknowledged, which also indicate directions for future research. First, the experimental environment was limited to Windows 10 (version 22H2) using the NTFS file system, and the live system was emulated through a VMware-based virtual machine. Although this controlled environment enabled consistent comparisons across tools, the findings may not be directly generalizable to other operating systems, such as Windows 11, macOS, or Linux, nor to different file systems (e.g., APFS or EXT-based systems). Moreover, certain hardware-dependent conditions—such as TPM-based disk encryption, low-level I/O behaviors, or firmware-level artifacts—may not be fully reproduced in a virtualized environment. Future studies should therefore adopt a dual-validation approach that combines controlled virtual environments with physical hardware-based experiments to enhance external validity. Second, the scope of analysis focused primarily on file system artifacts and Windows event logs during the search and selection phases of selective seizure. Other increasingly important investigative domains, such as cloud storage services, instant messaging platforms, remote access tools, and containerized or virtualized execution environments, were intentionally excluded to maintain experimental clarity. As digital evidence environments continue to diversify, extending the proposed framework to cover these domains will be essential for maintaining its relevance in contemporary investigations. Third, the evaluation was conducted on a limited set of six portable, GUI-based forensic tools selected for their practical applicability in field investigations. To mitigate product bias, tool names and version identifiers were anonymized, and all tools were tested using their latest available versions at the time of evaluation. While this approach strengthened neutrality, it also constrained strict reproducibility by third parties. Future research may address this issue by documenting reproducible version indicators such as build numbers, module versions, or hash values without disclosing product identities, thereby balancing objectivity and replicability.

Finally, the present study did not explicitly incorporate usability and operational burden into the evaluation metrics. In real-world selective seizure scenarios, factors such as the number of procedural steps, required analyst expertise, degree of automation, and interpretability of outputs can significantly affect investigative efficiency and error risk. Incorporating usability-oriented indicators alongside functional capabilities would further enhance the framework’s applicability to frontline investigative practice. Despite these limitations, this study contributes a structured and transparent evaluation framework that connects selective seizure functions with investigative efficiency and procedural compliance. By addressing the identified limitations, future research can extend the framework across platforms, environments, and investigative contexts, ultimately supporting more precise, proportionate, and legally robust digital evidence collection.

5. Conclusion

This study examined the importance of selective seizures based on digital evidence, and evaluated the functionality of six widely used tools to identify areas of improvement. First, the characteristics of digital evidence were used to evaluate the requirements for securing it, specifically, maintaining identity, reliability, and relevance to meet the admissibility criteria; then, the procedures, laws, and case precedents governing the selective seizure of evidence related to criminal activities in the field were reviewed. Subsequently, an evaluation model for selective seizure tools was developed encompassing key analysis items and a comprehensive dataset. Chapter 3 investigated new evaluation model analysis items for field response, reflecting the requirements covered in prior research on digital forensics tools. New field-response verification requirements were created based on existing requirement design indicators, and 6 types of digital forensics tools required for design and evaluation of verification requirement models were selected and datasets were developed. The results of the experiment, which involved three phases—search, select, and seize—revealed significant differences in the performances of the tools, allowing us to offer recommendations for improving their functionality. Specifically, in the search phase, Tools C and B outperformed NTFS parsing, whereas Tools C and B demonstrated superior capabilities in the Windows log analysis. In the selection phase, Tool C was most effective for file and folder name searches, Tool E for keyword searches, Tools B and C for file headers, Tool E for DRM and encrypted files, and Tool C for file previews. Tool E satisfied the evaluation criteria for data collection and extraction during the seizure phase. These findings offer valuable insight into the analysis and collection techniques of Windows forensic tools for field-based selective seizures. Therefore, they can assist forensic investigators in effectively analyzing and collecting digital evidence, thereby improving the efficiency and accuracy of their investigations. However, that study focused only on six portable tools implemented in an experimental environment comprising a virtual machine, an active system, Windows 10, and an NTFS. Future research should evaluate a wider range of tools geared toward other operating systems[46,47] such as Windows 11 and MacOS. Additionally, future research should explore the integration of artificial intelligence and machine learning techniques in selective seizure tools, particularly for cloud-based environments. AI-powered analytics could enhance the accuracy and efficiency of evidence identification in cloud storage, while also helping to address the challenges of data sovereignty and cross-jurisdictional investigations. The development of AI-assisted cloud forensic capabilities could provide investigators with more sophisticated tools for analyzing distributed digital evidence, though careful consideration must be given to maintaining the forensic integrity and admissibility of AI-processed evidence.

In addition, future investigations should consider incorporating various file systems and functions related to cloud storage[48,49,50], messaging applications, virtual environments, remote access programs, and third-party tools, all of which are being increasingly adopted. However, we expect that the findings of this study will contribute to the efficient acquisition of digital evidence using selective seizure tools, ultimately enhancing the capabilities of digital forensic investigations.