BEST PRACTICE IN THE FORENSIC EXAMINATION OF DIGITAL TECHNOLOGY

BEST PRACTICE IN THE FORENSIC EXAMINATION OF DIGITAL TECHNOLOGY

Info iconThis preview shows pages 1–4. Sign up to view the full content.

View Full Document Right Arrow Icon
Version 6 Working group Forensic IT www.enfsi.org GUIDELINES FOR BEST PRACTICE IN THE FORENSIC EXAMINATION OF DIGITAL TECHNOLOGY DOCUMENT TYPE : GUIDLINES REF. CODE: FIT-2005-001 ISSUE NO: 006 ISSUE DATE: 20/04/09 Contents This Document, which can be regarded as a Quality Assurance "core" document, is divided into the following sections : 1. AIMS 2. SCOPE 3. QUALITY ASSURANCE 4. ESTABLISHING THE CUSTOMER REQUIREMENT 5. CASE ASSESSMENT 6. PRIORITISATION AND SEQUENCE OF EXAMINATIONS 7. GENERAL PRINCIPLES APPLYING TO THE RECOVERY OF DIGITAL EVIDENCE 8. PRACTICES APPLICABLE TO DIGITAL EVIDENCE EXAMINATIONS 9. LOCATION AND RECOVERY OF DIGITAL EVIDENCE AT THE SCENE 10. LABORATORY EXAMINATIONS 11. EVALUATION AND INTERPRETATION 12. PRESENTATION OF WRITTEN EVIDENCE 13. CASE FILE REVIEW 14. PPRESENTATION OF ORAL EVIDENCE 15. HEALTH AND SAFETY 16. COMPLAINTS PROCEDURE 17. REFERENCES AND BIBLIOGRAPHY Best Practice Guide V6 Page 1 of 30 April 2009
Background image of page 1

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
Version 6 REVISION HISTORY The main content of this document was agreed in 2003 by the ENFSI Forensic IT Working Group. Version 4 was edited by Eric Freyssinet (ICGRN) and dr. Les Russell (Forensic Science Service – UK). The working group is grateful for all the hard work they put into generating the first version of these documents. The latest version of this document was discussed at the ENFSI FIT working group meeting held by the Guarda Civil on 1 st -3 rd October 2008 in Madrid. The final editing by dr. David Compton (Forensic Science Service – UK). Best Practice Guide V6 Page 2 of 30 April 2009
Background image of page 2
Version 6 1 AIMS 1.1 To provide a framework of standards, quality principles and approaches for the detection, recovery, examination and use of digital evidence for forensic purposes in compliance with the requirements of ISO/IEC 17025 and ILAC G19:2002, as interpreted for forensic science laboratories. 1.2 To provide a systematic approach for ENFSI member laboratories and other Law Enforcement forensic units to establish and maintain working practices in the field of digital evidence that will deliver reliable results, maximise the quality of information obtained and produce robust evidence. 1.3 To encourage more consistent methodology and hence the production of more comparable results, so as to facilitate interchange of data between laboratories. 2 SCOPE 2.1 This document is mainly focused on the requirements for the recovery of data from the following digital devices : Computer Related Media - hard disks, USB drives, smart media, flash memory, floppy discs and other storage media such as Zip, Jaz or Optical disks, Tapes and CD-ROMs. Mobile Phones Telecommunication data (e.g. Cell Site Analysis) Card Skimming devices digital devices associated to cars (e.g. GPS devices and car electronics) 2.2 However, the document stills related to requirements for other digital evidence casework and examination requests such as : Live Forensics – recovery of data from RAM memory in computers or recovery of
Background image of page 3

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
Image of page 4
This is the end of the preview. Sign up to access the rest of the document.

This note was uploaded on 04/06/2011 for the course CS 6963 taught by Professor Walterbruehs during the Spring '10 term at NYU Poly.

Page1 / 30

BEST PRACTICE IN THE FORENSIC EXAMINATION OF DIGITAL TECHNOLOGY

This preview shows document pages 1 - 4. Sign up to view the full document.

View Full Document Right Arrow Icon
Ask a homework question - tutors are online