NIST Publishes Review of Digital Forensic Methods
ACORE Hosts 2022 Finance Forum in New York – ACORE
June 23, 2022
Texas RE’s Annual Assessment of Reliability Performance Now Available
June 24, 2022
Did you know that forensics experts can retrieve data from your phone even if you try to destroy your device by smashing, shooting or cooking it? Yes, it’s true! They can use hardware and software tools to directly access the memory chip of a phone that doesn’t even power on.
The use of digital devices in our society today is very common, which is why these devices and artifacts play a central role in providing evidence during criminal investigations. It is the job of digital experts to find evidence hidden by criminals in illicit text messages, images, and videos, from mobile phones, tablets, etc.
How reliable are these digital forensic methods?
Since this evidence needs to be produced in the court of law, it is extremely important to make sure that the methods being used to retrieve the evidence are trustworthy. Thus, the National Institute of Standards and Technology (NIST) has undertaken a study to test the reliability and the scientific basis of these forensic methods and their results. The initial release of the report, Digital Investigation Techniques: A NIST Scientific Foundation Review, is a draft document and is open for public comment for 60 days, through July 11, 2022. For more information on how to submit your comments, please visit the NIST website.
According to a news release by NIST, in order to conduct the review, the authors of the report peer-reviewed literature, documentation from software developers, best practices and standards documents, forensic tools results and various other sources. They found that, “digital evidence examination rests on a firm foundation based in computer science,” and that “the application of these computer science techniques to digital investigations is sound.”
The leader of NIST’s digital forensics research program and an author of the study, Barbara Guttman said, “Copying data, searching for text strings, finding timestamps on files, reading call logs on a phone; these are basic elements of a digital investigation.” She added, “And they all rely on fundamental computer operations that are widely used and well understood.”
Challenges and recommendations discussed in the draft report
Several challenges that are faced by forensic experts have also been pointed out in the report, including the rapid pace of technological change. According to the news release by NIST, Guttman said, “Digital evidence techniques don’t work perfectly in all cases.” She went on to explain, “If everyone starts using a new app, forensic tools won’t be able to read and understand the content of that app until they are updated. This requires constant effort.”
To overcome these challenges, the authors of the draft report recommended:
- Improved methods of information sharing between experts;
- A more structured approach to testing with forensic tools;
- Increased efficiency and reduced duplication of effort across labs; and
- Increased sharing of high-quality forensic reference data that may be used for education, training, developing, and testing new forensic tools.
