±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 34485
New Yesterday: 1 Visitors: 139

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Long Term Archiving for Evidence; Best Practices - Plus

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Long Term Archiving for Evidence; Best Practices - Plus

Post Posted: Mon May 14, 2018 5:10 pm

I am posting this question for myself and for a Cincinnati, Ohio Officer, who brought to my attention that the size of cases has been growing and tasking his budget and physical storage (both device and physical storage) space. The policy for evidence that his agency follows is
fifteen (15) years plus (+) current year
.
I asked about which current standards body do they (his agency) adhere to and he said,
There is nothing to direct you to. All of the documents are so vague that individual units and agencies are left to figure it out on their own. Most agencies have a policy like ours …

I brought to his attention that the Scientific Working Group on Digital Evidence and the Scientific Working Group Imaging Technology both have currently active documents for this concern.

A member of this site from Pennsylvania in the General Discussion Forum under the topic " Best Practice: Archiving Digital Evidence " says,
I've found some information regarding the topic from the FBI, ACPO, NIST and a couple other sources. I'm having a little trouble finding specific standards set in place by ISO or other governing bodies.

The Cincy officer also indicated,
But from the time of conception to the time the document is release there have been 2 generations of hardware and OS. Additionally, the documents have to be so general that they are frequently useless. In this instant discussion – the SWGDE guidelines are so vague that they are largely useless. If SWGDE isn’t the group that should decide what the 'best practices' are – then who should do that ? Hence our current discussion.


Here are links to the Group's currently found document's on Archiving Digital Evidence :

SWGDE Data Archiving Version: 1.0 (April 12, 2006)

< www.swgit.org/pdf/Sect...m?docID=55 > of 2012


1. Some of our questions are then: What are other people / agencies doing – what ideas have they had – can we share that information so we can see if there are better ideas out there somewhere.
2. Anybody have a better solution – or a way to bring the volume of data storage from today’s size cases into compliance with case retention policies written in the paper era ?
3. What file format(s) do you use or keep your archive data in ?
4. Do you use compression within your software or do you use an exterior Open Source tool to save space for this case data archive ?


So we are asking the members of this site for your ideas and also to compare what and how you handle these issues within each of our geographical communities. It would be nice to see if there are any commonalities that could be helpful to us all.

Here are a few other Threads from this site regarding this subject, that you may want to review :

< www.forensicfocus.com/...ic/t=7602/ >
< www.forensicfocus.com/...ic/t=2580/ >
< www.forensicfocus.com/...ic/t=5409/ >

We thank you for your participation in this Forum's question, ahead of time .....  

Hwallbanger
Member
 
 

Page 1 of 1