Standardizing digital forensic examination procedures: A look at Windows 10 in cases involving images depicting child sexual abuse

Abstract

As a topic area, the need for the standardization of operational practices in digital forensics has seen much discussion. There are clear benefits for digital forensics if its procedures can be harmonized including increasing the reliability of the work produced by its practitioners, consistency of practice, and the potential for greater quality control, however, attaining standardization is a difficult task, and further work in this field is required. This work discusses the “standardization challenge” assessing both the need for standardization and the feasibility of achieving it. It is suggested that those actively contributing in this area should consider the development of models for defining operational practice which are offence‐specific, device‐specific and operating system‐specific. To support this proposal, an example standard is offered and discussed which suggests and documents the minimum expected requirements for the examination of Windows 10 devices in cases involving images depicting child sexual abuse. This article is categorized under: Digital and Multimedia Science > Cybercrime Investigation

The long journey of resistance toward acceptance: Understanding digital forensic accreditation in England and Wales from a social science perspective

“…Our analysis complements discussions about the use of standards in forensic science in this journal (e.g., Doyle, 2020; Horsman, 2021) and elsewhere (e.g., Brandi & Wilson‐Wilde, 2013; Doyle, 2018; Evison, 2018; McCartney & Amoako, 2019; Page et al, 2019; Tully, 2018, 2020; Tully et al, 2020; Willis, 2011; Wilson‐Wilde, 2018), and offers an insight into the tensions DF forensic science providers experience in achieving compliance with ISO/IEC 17025 and in updating their existing practices, processes and systems. The article is organized as follows: the next section briefly introduces the context of forensic science services in England and Wales, the role of the Forensic Science Regulator and the adoption of ISO/IEC 10725.…”

“…Harmonization and standardization of practices and quality control in DF have been at the forefront of practitioner debates, in the United Kingdom and elsewhere (e.g., Casey, 2004Casey, , 2019Horsman, 2021;Sommer, 2011). Almost 20 years ago, in the inaugural issue of the journal Digital Investigation, Casey's editorial highlighted the unequal development of guidelines and training across DF communities.…”

“…It is not our intention to analyze the standard here, as other accounts have covered this issue far more comprehensively (see Doyle, 2020). Neither it is to enter the "right" or "wrong" standard debate or propose a new standardization model (Horsman, 2021). Instead, we examine how the introduction of this standard has been both reflected in DF scholarship and experienced in practice.…”

ABAC as Access Control Solution for Digital Evidence Storage

“…A series of digital forensics stages support efforts to disclose cybercrime cases through digital investigative activities to obtain evidence relevant to the investigation case. Digital forensics itself, according to [5] and [6], is an activity based on scientific methods and the application of forensic principles to digital evidence so that it becomes a support for legal evidence and trials. The critical factor in a cybercrime investigation process is related to evidence divided into electronic and digital evidence [7], [8].…”