Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
The paper introduces test-driven forensics, a methodology that uses executable specifications to validate forensic expectations and detect regressions in artifact behavior and tool outputs across software versions. This approach, implemented in the open-source ADARE framework, enables state transition testing by validating system states after user actions, supporting causal attribution. A 25-version regression study of Autopsy using ADARE revealed substantial undocumented changes in exported report outputs, demonstrating the scalability and reproducibility of the method for detecting drift.
Forensic tool outputs change substantially across versions, and this paper shows how to make that drift measurable and reproducible at scale.
Digital forensic relies on validated tools and established procedures, yet the underlying operating systems, applications, and analysis tools evolve rapidly. This evolution can cause artifact behavior and tool outputs to drift, silently degrading repeatability and confidence in long-lived forensic interpretations. We present test-driven forensics, a practical approach that treats forensic expectations as executable specifications: expected artifacts and expected tool outputs are encoded as tests that can be rerun across versions to detect regressions. Crucially, our approach also enables State Transition Testing, validating the system's expected state after each user action rather than only performing post-mortem checks on a final disk image; this supports causal attribution and makes transient behavior testable. We implement the methodology in ADARE, an open-source framework that runs controlled experiments in virtual machines and simulates realistic user activity via computer-vision-guided GUI automation. ADARE includes a companion web platform for sharing experiments, environments, and results to facilitate independent reruns and peer verification. We evaluate ADARE in five case studies spanning artifact research and tool validation. In particular, a 25-version regression study of Autopsy reveals substantial, largely undocumented changes in exported report outputs, demonstrating how executable tests make drift measurable and reproducible at scale.