±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35399
New Yesterday: 1 Visitors: 163

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Standardization of witness statements / reports - possible?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2, 3  Next 
  

tootypeg
Senior Member
 

Standardization of witness statements / reports - possible?

Post Posted: Jun 28, 16 07:22

Hi all,

Just wanted to gather your thoughts on a few things and particularly a piece of work I am currently looking into. Basically its looking at standardisation but from a report and evidence description point of view. It interesting that this was sort of mentioned in the 'New digital forensics textbook - soliciting suggestions' thread (sort of), but from an evidence misunderstanding point of view.

I was wondering if it is possible as a field to develop a standard set of technical language /definitions which can be globally used in all reports. In addition to develop a set of criteria which must be met in order to be able to use such a definition in a court report.

For example, as a field we might define and explain what an internet history record as 'A, B & C'. And in order to be able to use that definition, conditions 'X, Y & Z' must be present in the case. I am thinking that this could lead to greater consistency across all cases if every practitioner used it and provide courts with a consistent and known precedent description of different types of evidence for which they could become familiar with and get a handle on the conditions surrounding it. It would also potentially stop the potential for misinterpretation of content from inconsistent descriptions.

....I dont know if im talking rubbish here, but in my head on the way to work, it seemed to make sense Shocked . would be interested to hear thoughts on this, particularly on feasibility and the need for it, and whether anyone might be interested collaborating /working on it if its useful?  
 
  

jaclaz
Senior Member
 

Re: Standardization of witness statements / reports - possib

Post Posted: Jun 28, 16 08:15

That would be a "glossary" 8O, something more or less like:
www.alpineguild.com/gl...ortant.htm

Judging from this attempt (seemingly failed/not finalized) at a single definition:
www.forensicfocus.com/...ic/t=9374/
it won't be easy. Sad

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

tootypeg
Senior Member
 

Re: Standardization of witness statements / reports - possib

Post Posted: Jun 28, 16 08:28

Sort of but a bit more comprehensive. As I think we would also need to define criteria that must be met before we could use a certain definition. For example, certain data is present to allow for the accurate use of the definition in the first place.

Suppose my questions are then:

1. Would it be worth it?
2. Is it feasible to implement?
3. How would a global definition be agreed upon and developed?
4. Would it likely be adopted in industry and what are the likely pitfalls?  
 
  

jaclaz
Senior Member
 

Re: Standardization of witness statements / reports - possib

Post Posted: Jun 28, 16 16:41

- tootypeg

Suppose my questions are then:

1. Would it be worth it?
2. Is it feasible to implement?
3. How would a global definition be agreed upon and developed?
4. Would it likely be adopted in industry and what are the likely pitfalls?


I like this way of making a conversation Smile
Suppose that my personal answers are:
1. Yes, very much, anything that helps in correctly exchange ideas and knowledge and reduce misunderstandings is worth it.
2. Yes, i don't see why it should not be feasible, maybe as said not easy, but definitely feasible, there is some previous art in making glossaries and vocabularies, so I would say it is doable.
3. Tricky question, we could elect a committee of experts and then ... [1] Rolling Eyes
4. You can forget about it. The technical people will be against it (because they know better or think they do), the lawyers will raise every kind of exception because the adoption would make documents more readable and understandable by the laymen, the marketing guys will be against it as they would not be anymore able to leverage on the ambiguities of the definitions (or maybe that's the reason for the lawyers to be against it Wink ). Maybe a small subset of the industry could found a guild (or a club) and adopt the glossary/definitions as part of its ethical code of conduct, but I wouldn't bet on this to happen.

To sum it up, IMHO it could be an exceptionally good resource Smile as a reference and as part of training/education, but let me doubt that anyone will ever "adopt" it (or something similar) officially or that it will ever be given an "approved" status by anyone Crying or Very sad .

If you think about it, it is years that we have different software that insists on calling the same thing in a slightly different way, OT, as an example, check this (very old) thing I wrote:
jaclaz.altervista.org/...stick.html
(scroll about half length you will find a couple "Cross Reference" tables)
Though I am not familiar with (say) Encase and AccessData software, I am pretty much sure that the same differences in terminology is all over those two programs (and in the reports they generate) and a third forensic tool will surely have yet more different definitions.

jaclaz

[1] An image is worth a thousand words:
www.projectcartoon.com/create/
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

tootypeg
Senior Member
 

Re: Standardization of witness statements / reports - possib

Post Posted: Jun 30, 16 19:58

would anyone fancy foruming such a panel to discuss / get the ball rolling on something like this?  
 
  

bravo1800
Member
 

Re: Standardization of witness statements / reports - possib

Post Posted: Jul 22, 16 13:58

Just for your attention. INTERPOL have a Digital Forensics Expert Group which was recently held in Madrid and one of the feedback from the attendees was assistance with SOPs along with the items discussed within this post. We would be happy to discuss this with people and try and set up a working group to try and achieve this if required. If this of interest to you then please PM me and we can discuss.

Regards

Chris  
 
  

Chris_Ed
Senior Member
 

Re: Standardization of witness statements / reports - possib

Post Posted: Jul 22, 16 14:09

I believe something like this has already been attempted in UK LE under the umbrella of "Streamlined Forensic Reporting". However as far as I am aware it hasn't been implemented by many Hi-Tech Crime Units.  
 

Page 1 of 3
Page 1, 2, 3  Next