±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35615
New Yesterday: 0 Visitors: 152

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Standardization of witness statements / reports - possible?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3  Next 
  

dan0841
Senior Member
 

Re: Standardization of witness statements / reports - possib

Post Posted: Jul 27, 16 01:52

- Chris_Ed
I believe something like this has already been attempted in UK LE under the umbrella of "Streamlined Forensic Reporting". However as far as I am aware it hasn't been implemented by many Hi-Tech Crime Units.


Yes, there is a template for IIoC SFR which has been proposed in the UK and is increasingly being adopted by Forces. This is for use in IIoC cases and provides all of the information required for CPS to make a charging decision, as well as meeting the requirements for the SAP Aggravating / Mitigating factors. I've chatted to Prosecutors who are very keen and think they are a breath of fresh air. They provide all key information, use absolute laymans terminology and remove all of the technical in statements that were never relevant in 99.99% cases.

It does standardise some definitions, particularly ones which have been used by different organisations/examiners to mean different things. The key example is the term 'accessible'.

The UK CPS use this term to define whether an image is accessible to a user and used to determine whether images should be charged as 'possession' (CJA 1988) or 'Making' (PCA 1978). This is becoming a mute point following the latest DPP guidance, however, it is still required to report on accessible/inaccessible.

It used to get confused by forensic practitioners who would report artefacts like 'Temporary Internet Files' is a statement as 'accessible'. This is because 'technically' they are (if you know where/how to look). However, to be in 'custody and control' of an image (Possession) a user needs to know of its existence (See case Law).......... and most people on the street would never have heard of Internet Cache) never mind be able to find pictures in one.


So.....in the SFR a standard definition was agreed for 'accessible'........... and that was difficult!!

So.....good idea!!.....but good luck getting agreement Wink

BTW - The SFR process has the ability to be a game changer for reporting digital forensics in the UK courts. It is worth reading up on for anyone interested in UK based forensics and IMHO is the way forward for many LE HTCUs.  
 
  

DCS1094
Senior Member
 

Re: Standardization of witness statements / reports - possib

Post Posted: Jul 27, 16 02:42

- dan0841
Yes, there is a template for IIoC SFR which has been proposed in the UK and is increasingly being adopted by Forces. This is for use in IIoC cases and provides all of the information required for CPS to make a charging decision, as well as meeting the requirements for the SAP Aggravating / Mitigating factors. I've chatted to Prosecutors who are very keen and think they are a breath of fresh air. They provide all key information, use absolute laymans terminology and remove all of the technical in statements that were never relevant in 99.99% cases.


We use SFR's all the time for exactly this purpose and I fully agree with the aformentioned comments! Lets get straight to the main points that need to be understood and cut out all the garbage which will confuse the situation. If further clarification is required, then a stage 2 report can be done to address the specific queries. Personally never had any issues with them...  
 
  

Chris_Ed
Senior Member
 

Re: Standardization of witness statements / reports - possib

Post Posted: Jul 27, 16 13:48

Interesting stuff, folks - I wasn't aware that the SFR had been adopted for IIoC cases. Can I PM one of you to get some more details? I have a CJSM email account if that helps.

Thanks!

By the way:

This is becoming a mute point following the latest DPP guidance..


..???!?!???

Any further info on this? (Fully agree about Temporary Internet Files by the way)  
 
  

tootypeg
Senior Member
 

Re: Standardization of witness statements / reports - possib

Post Posted: Jul 27, 16 15:44

Ahh this is very interesting. Is there any way to get a hold of SFR templates for digital forensics?

I did wonder about this as technical and legal definitions of terms dont always fit and therefore I can see the importance of having some form of agreed/standardized report based on the target audience. I can also see how technically, 'accessible' definitions dont fit comfortably with legal ones.

My thoughts are that instead of trying to define accessible to cover both disciplines, why not keep it simple with live / deleted then define the location (cache) and follow current precedents as to why this is normally (subject to knowledge) considered to be an area not within possession.

I think this raises a topic for some substantial debate and further work!  
 
  

jaclaz
Senior Member
 

Re: Standardization of witness statements / reports - possib

Post Posted: Jul 27, 16 21:17

Isn't it all official/public?

www.cps.gov.uk/legal/s...d_toolkit/
www.cps.gov.uk/legal/s...r_q_and_a/

It would be "queer" if such a resource/methodology would have been kept secret. Confused

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

dan0841
Senior Member
 

Re: Standardization of witness statements / reports - possib

Post Posted: Jul 28, 16 00:20

- jaclaz
Isn't it all official/public?

www.cps.gov.uk/legal/s...d_toolkit/
www.cps.gov.uk/legal/s...r_q_and_a/

It would be "queer" if such a resource/methodology would have been kept secret. Confused

jaclaz


Yes - The SFR info is all public, although I'm not sure if the SFR22(b) IIoC template agreed by the National Digital SFR group is. I'll have to look into that.

I've started a new post to discuss the SFR & new IIoC guidance because it goes off on a tangent and I didn't want to hijack the thread. All of the info is on the CPS links jaclaz and myself have provided in the new thread.

Cheers

Dan  
 
  

Chris_Ed
Senior Member
 

Re: Standardization of witness statements / reports - possib

Post Posted: Jul 28, 16 12:00

- jaclaz
Isn't it all official/public?

www.cps.gov.uk/legal/s...d_toolkit/
www.cps.gov.uk/legal/s...r_q_and_a/

It would be "queer" if such a resource/methodology would have been kept secret. Confused

jaclaz

Sorry, I wasn't trying to suggest anything clandestine - it's more that some people might be reluctant to reveal exactly which Police force they work for on a public forum. Smile  
 

Page 2 of 3
Page Previous  1, 2, 3  Next