  Following a series of high profile miscarriages of justice in the UK linked
to questionable expert evidence, the post of the Forensic Science Regulator was
created in 2008. The main objective of this role is to improve the standard of
practitioner competences and forensic procedures. One of the key strategies
deployed to achieve this is the push to incorporate a greater level of
scientific conduct in the various fields of forensic practice. Currently there
is no statutory requirement for practitioners to become accredited to continue
working with the Criminal Justice System of England and Wales. However, the
Forensic Science Regulator is lobbying the UK Government to make this
mandatory. This paper focuses upon the challenge of incorporating a scientific
methodology to digital forensic investigations where malicious software
('malware') has been identified. One aspect of such a methodology is the
approach followed to both select and evaluate the tools used to perform dynamic
malware analysis during an investigation. Based on the literature, legal,
regulatory and practical needs we derive a set of requirements to address this
challenge. We present a framework, called the 'Malware Analysis Tool Evaluation
Framework' (MATEF), to address this lack of methodology to evaluate software
tools used to perform dynamic malware analysis during investigations involving
malware and discuss how it meets the derived requirements.
