{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,9]],"date-time":"2026-04-09T04:56:51Z","timestamp":1775710611696,"version":"3.50.1"},"reference-count":37,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2026,4,7]],"date-time":"2026-04-07T00:00:00Z","timestamp":1775520000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Digital"],"abstract":"<jats:p>The increasing volume and complexity of digital evidence pose significant challenges to its lawful collection and admissibility, particularly in on-site investigative contexts. Selective seizure has emerged as a critical approach for minimizing unnecessary data acquisition while ensuring procedural legality, privacy protection, and investigative efficiency. However, despite its growing importance, systematic evaluation criteria for selective seizure capabilities in digital forensic tools remain underdeveloped. This study proposes a structured evaluation framework for assessing selective seizure functions in Windows-based forensic tools, with a focus on live-response environments. Essential selective seizure functions were identified and organized into three investigative phases\u2014search, selection, and seizure\u2014reflecting practical field procedures. Based on this framework, a dedicated evaluation dataset was constructed, and six representative portable forensic tools were empirically evaluated under a controlled Windows 10 (NTFS) environment simulating active system conditions. The experimental results demonstrate notable differences in tool capabilities across investigative phases. In the search phase, variations were observed in NTFS parsing and Windows artifact analysis, while the selection phase revealed disparities in file filtering, keyword search, encrypted file handling, and preview functions. In the seizure phase, only a subset of tools sufficiently supported evidence collection, integrity verification, and reporting requirements necessary for selective seizure. These findings highlight that no single tool uniformly satisfies all functional requirements, underscoring the need for context-dependent tool selection. The proposed framework and evaluation results provide practical guidance for digital forensic practitioners in selecting appropriate tools for selective seizure in field investigations. Moreover, this study contributes a reproducible methodological foundation for future research on selective seizure evaluation, supporting the development of more precise, proportionate, and legally robust digital evidence collection practices in Windows-based forensic investigations.<\/jats:p>","DOI":"10.3390\/digital6020029","type":"journal-article","created":{"date-parts":[[2026,4,8]],"date-time":"2026-04-08T07:25:12Z","timestamp":1775633112000},"page":"29","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Designing and Validating a Forensic Evaluation Model for Selective Seizure Capabilities in Windows Forensic Tools"],"prefix":"10.3390","volume":"6","author":[{"given":"Sun-Ho","family":"Kim","sequence":"first","affiliation":[{"name":"AbleSECU, Seoul 07788, Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4862-4790","authenticated-orcid":false,"given":"Cheolhee","family":"Yoon","sequence":"additional","affiliation":[{"name":"Laboratory of Autonomous Vehicle and Block-Chain, Korean National Police University, Asan 31539, Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2026,4,7]]},"reference":[{"key":"ref_1","unstructured":"G. O. Presidential Decree, Republic of Korea (2026, February 26). Regulations on Mutual Cooperation Between Prosecutors and Judicial Police Officers and General Investigative Principles, Article 41, Paragraphs 1, 2, 3, Available online: https:\/\/www.law.go.kr\/lsInfoP.do?ancYnChk=0&lsId=013871."},{"key":"ref_2","unstructured":"(2026, February 26). Desktop Windows Version Market Share Republic of Korea. StatCounter Global Stats. Available online: https:\/\/gs.statcounter.com\/windows-version-market-share\/desktop\/south-korea."},{"key":"ref_3","unstructured":"(2026, February 26). Computer Forensics Tools & Techniques Catalog-Tool Search, Available online: https:\/\/toolcatalog.nist.gov\/search\/."},{"key":"ref_4","unstructured":"(2026, February 26). Desktop Hypervisor Solutions|VMware. Available online: https:\/\/www.vmware.com\/products\/desktop-hypervisor\/workstation-and-fusion."},{"key":"ref_5","first-page":"193","article-title":"A Proposal to Establish an Independent Analysis Institution in Digital Evidence Seizure and Search","volume":"27","author":"Lee","year":"2025","journal-title":"Comp. Crim. Law Rev. (Bijogyo Hyeongsa Beom Yeongu)"},{"key":"ref_6","unstructured":"Lee, H. (2025). A Study on the Transfer of Irrelevant Information and the Seizure of Unrelated Information. [Master\u2019s Thesis, Seoul Nat\u2019l University]."},{"key":"ref_7","unstructured":"Lee, S.Y. (2024). A Study on Digital Evidence Screening Based on Metadata Similarity. [Master\u2019s Thesis, Sungkyunkwan University]."},{"key":"ref_8","unstructured":"Cheon, S. (2024). A Study on Improvement Measures for Efficient On-Site Selective Seizure and Search of Digital Information: Focusing on the Analysis of Keyword Search Time and the Possibility of Metadata Modification. [Ph.D. Thesis, Sungkyunkwan University]."},{"key":"ref_9","unstructured":"Oh, J. (2023). A Study on Problems and Improvement Measures Following the Conceptual Shift in Selective Seizure of Digital Evidence. [Master\u2019s Thesis, Seoul Nat\u2019l University]."},{"key":"ref_10","unstructured":"Heo, J. (2023). A Study on Problems in Selective Seizure of Digital Evidence and Efficient Seizure Measures. [Master\u2019s Thesis, Seoul Nat\u2019l University]."},{"key":"ref_11","unstructured":"Kim, Y. (2022). A Study on Issues with the \u2018On-Site\u2019 and \u2018Selective\u2019 Principles in Search and Seizure of Digital (Electronic) Evidence and Technical\/Legal Improvement Measures: Focusing on the Need to Amend Article 106(3) of the Criminal Procedure Act. [Master\u2019s Thesis, Seoul Nat\u2019l University]."},{"key":"ref_12","first-page":"239","article-title":"A study on digital evidence automatic screening system","volume":"14","author":"Yoon","year":"2020","journal-title":"J. Digit. Forensics KDFS"},{"key":"ref_13","first-page":"73","article-title":"A digital forensic analysis for directory in Windows file system","volume":"11","author":"Cho","year":"2015","journal-title":"J. Korea Soc. Digit. Ind. Inf. Manag."},{"key":"ref_14","unstructured":"Shin, Y. (2019). A Study on Field Detection Techniques for Non-Searchable Email Attachments. [Master\u2019s Thesis, Seoul National University]."},{"key":"ref_15","first-page":"165","article-title":"Reliability verification of evidence analysis tools for digital forensics","volume":"21","author":"Lee","year":"2011","journal-title":"J. Korea Inst. Inf. Secur. Cryptol."},{"key":"ref_16","first-page":"15","article-title":"A study on the comparison of modern digital forensic imaging software tools","volume":"19","author":"Ham","year":"2019","journal-title":"J. Korean Inst. Internet Broadcast. Commun."},{"key":"ref_17","first-page":"1397","article-title":"Development of a set of data for verifying partition recovery tool and evaluation of recovery tool","volume":"27","author":"Park","year":"2017","journal-title":"J. Korea Inst. Inf. Secur. Cryptol."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"723","DOI":"10.1007\/s10586-016-0553-1","article-title":"Big forensic data reduction: Digital forensic images and electronic evidence","volume":"19","author":"Quick","year":"2016","journal-title":"Clust. Comput."},{"key":"ref_19","first-page":"1421","article-title":"Development of Windows forensic tool for verifying a set of data","volume":"25","author":"Kim","year":"2015","journal-title":"J. Korea Inst. Inf. Secur. Cryptol."},{"key":"ref_20","unstructured":"Lee, D. (2015). A Quality Evaluation Model Based on ISO\/IEC 9126 for Digital Forensic Tools. [Master\u2019s Thesis, Soongsil University]."},{"key":"ref_21","first-page":"54","article-title":"Introduction to the NIST digital forensic tool verification system","volume":"26","author":"Park","year":"2016","journal-title":"Rev. KIISC"},{"key":"ref_22","unstructured":"(2026, February 26). CFReDS Portal, Available online: https:\/\/cfreds.nist.gov\/."},{"key":"ref_23","unstructured":"(2026, February 26). Hosting Various Seminars Related to Digital Forensics from 2001 to the Present, DFRWS. Available online: https:\/\/dfrws.org\/."},{"key":"ref_24","unstructured":"National Institute of Standards and Technology (NIST) (2026, March 04). Computer Forensics Tool Testing (CFTT) Program, Available online: https:\/\/www.nist.gov\/itl\/ssd\/software-quality-group\/computer-forensics-tool-testing-program-cftt."},{"key":"ref_25","unstructured":"National Institute of Standards and Technology (NIST) (2026, March 04). Computer Forensic Reference Data Sets (CFReDS), Available online: https:\/\/www.nist.gov\/programs-projects\/computer-forensic-reference-data-sets."},{"key":"ref_26","unstructured":"Private Qualification Information Service (PQI) (2026, March 04). Digital Forensics Expert Qualification Exam: Issuing Body\u2014Korea Forensic Society; Co-Issuing Body\u2014Korea Internet & Security Agency (KISA). Available online: https:\/\/www.pqi.or.kr\/inf\/qul\/infQulBasDetail.do?qulId=2672."},{"key":"ref_27","unstructured":"Korea Forensic Society (2026, March 04). Digital Forensics Expert Qualification Exam Portal. Available online: https:\/\/exam.forensickorea.org\/web\/main.do."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"S75","DOI":"10.1016\/j.diin.2016.01.010","article-title":"Tiered forensic methodology model for Digital Field Triage by non-digital evidence specialists","volume":"16","author":"Hitchcock","year":"2016","journal-title":"Digit. Investig."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Rogers, M.K., Goldman, J., Mislan, R., Wedge, T., and Debrota, S. (2006). Computer Forensics Field Triage Process Model. J. Digit. Forensics Secur. Law, 1.","DOI":"10.15394\/jdfsl.2006.1004"},{"key":"ref_30","first-page":"301264","article-title":"Dataset construction challenges for digital forensics","volume":"38","author":"Horsman","year":"2021","journal-title":"Forensic Sci. Int. Digit. Investig."},{"key":"ref_31","first-page":"301554","article-title":"Reliability validation enabling framework (RVEF) for digital forensics in criminal investigations","volume":"45","author":"Stoykova","year":"2023","journal-title":"Forensic Sci. Int. Digit. Investig."},{"key":"ref_32","unstructured":"(2012). Information Technology\u2014Security Techniques\u2014Guidelines for Identification, Collection, Acquisition and Preservation of Digital Evidence. Standard No. ISO\/IEC 27037:2012. Available online: https:\/\/www.iso.org\/standard\/44381.html."},{"key":"ref_33","unstructured":"(2015). Information Technology\u2014Security Techniques\u2014Guidelines for the Analysis and Interpretation of Digital Evidence. Standard No. ISO\/IEC 27042:2015. Available online: https:\/\/www.iso.org\/standard\/44406.html."},{"key":"ref_34","unstructured":"Domingues, P., Frade, M., and Negr\u00e3o, M. (August, January 30). Digital Forensic Artifacts of FIDO2 Passkeys in Windows 11. Proceedings of the 19th International Conference on Availability, Reliability and Security (ARES\u201924), Vienna, Austria."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Plum, J., and Dewald, A. (2018, January 27). Forensic APFS File Recovery. Proceedings of the 13th International Conference on Availability, Reliability and Security (ARES\u201918), Hamburg, Germany.","DOI":"10.1145\/3230833.3232808"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Herman, M., Iorga, M., Salim, A.M., Jackson, R.H., Hurst, M.R., Leo, R., Lee, R., Landreville, N.M., Mishra, A.K., and Wang, Y. (2020). NIST Cloud Computing Forensic Science Challenges, NIST Interagency\/Internal Report (NIST IR) 8006.","DOI":"10.6028\/NIST.IR.8006"},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"81","DOI":"10.1016\/j.diin.2012.05.015","article-title":"Digital forensic investigation of cloud storage services","volume":"9","author":"Chung","year":"2012","journal-title":"Digit. Investig."}],"container-title":["Digital"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2673-6470\/6\/2\/29\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,9]],"date-time":"2026-04-09T04:34:59Z","timestamp":1775709299000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2673-6470\/6\/2\/29"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,7]]},"references-count":37,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2026,6]]}},"alternative-id":["digital6020029"],"URL":"https:\/\/doi.org\/10.3390\/digital6020029","relation":{},"ISSN":["2673-6470"],"issn-type":[{"value":"2673-6470","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,4,7]]}}}