CoE Electronic Evidence Guide

elude ?

typo or subliminal wish? 

jaclaz

Posted by: @jaclaz

elude ?

typo or subliminal wish? 

jaclaz

I take your point.

I use the term elude - is its absence intentionally applied as an escape for not having to mention it at all - e.g. this document doesn't say why Standard ISO.17025 having direct impact on evidence acquisition wasn't mentioned. Equally, the document doesn't refer directly to ISO.17025, generally, so why is that, a simple omission?

I thought you were saying allude to, not elude (that doesn't have the to)?

jaclaz

Posted by: @trewmte

The voice of those who should be heard concerning digital evidence are those in the digital forensic communities. Rarely, if at all, in these types of document do you read the experiences of a broad-based collection of practitioners and which, undoubtedly, if heard could furnish Police Officers, Prosecutors and Judges with most helpful and pragmatic views experienced from working/researching at the coalface of digital forensics today.

And this is the entire problem. Continually they force things downwards without consulting those with the most knowledge and experience of doing the job day in day out.

To quote the recent article on this site, quoting the forensic regulator:

Done well, with appropriate leadership and support, they can lead to great improvement; done poorly, however, they might amount to nothing more than assigned tasks, box-ticking, and progress that grinds to a halt.

In the same speech at DFRWS 2020, the regulator cites justification for standardisation, as R v Allen, and then goes on to say accreditation actually wouldn't have made any difference to that!

Fundamentally ISO17025 is a bit of a joke and they need to separate things into practically achievable categories and areas that require excessive process following with no meaningful gain.

The software/tool testing aspect is a giant duplication of effort, under the guise of achieving reliability (or to provide the illusion of it), which it simply isn't going to do.

In a paper by the forensic regulator and others, cited in the article on this board, they acknowledge this (finally) to a degree:

Central resources for tool testing, such as that at the National Institute for Standards and Technology (NIST), have the potential to reduce duplication of effort (accepting that organisations would still need to validate their end to end methods). Similarly, the provision of central resources for development and validation of standard methods has the potential to substantially reduce, although not eliminate, the validation burden on each organisation.

There needs to be the acceptance that forensic tools ARE NOT reliable in an absolute sense and that's not achievable.

Shifting the focus of ISO for digital forensics, to having documents and processes, for standard operations, allowing for deviation from that, when those processes don't work or apply, and accepting that the analysis of generated data is something that is not infalible, no matter how much you test, would be a significant improvement.

I think if they engaged more (or at all) with examiners, I don't think you'd find many people who're arguing against having a process, and documenting their work.

They cite the NIST example, and I still think they really need to change tack from enforcing largely futile limited testing on everyone, and perform both centralised testing of most of the common forensic tools, in tandem with allowing a centralised bug reporting system.

I would venture that having a list of current problems in the tools, contributed to by everyone, would help avoid errors in data far more than the current system of testing a piece of software against the same limited data set, once in a while.

If it was mandatory for an analyst to report problems that they identify, both to the software vendor, as well as a shared public resource. I suspect there would be increased effort on resolving these bugs on the part of the vendors and it would be far easier for analysts to be aware of problems and avoid them.

@Rich2005 it is my suspicion that the CoE document is an attempt to make good on any Guides out there that suggest, by taking a global view, avoids fettering the document with localised restrictions, leaving it to others to do that. However, CoE is European in origin but it is not a state, nor a country and so adoption of global guidelines needs to be placed in context with why in Europe ISO.17025 was pushed so much. 

It is confusing where these bodies keep producing there own version of events which they prescribe is 'how things are', whereas in reality most of the digital forensics community would say stop doing this and we require one document that collectively includes not just policy makers or process walkers opinions but those who work at the coalface. The heros of the digital forensics community are being neglected and that isn't 'fairness' (perhaps akin to the right to fairness under s78 PACE 1984). As an anology, this situation is like the person who wheels the patient in on a trolley into hospital surgery theatre to then set down the guidance how brain surgeons should to do their jobs and how hospital administrates need guidance on that. It is the brain surgeons who are being ignored.

Indeed.

It's extremely frustrating.

It seems like every time an untrained officer does some forensics or interprets it (instead of a DF analyst) or someone doesn't disclose something, the answer seems to be ISO17025 and accreditation (despite obviously never being able to give any justification why that would help resolve those issues).

I think it's pretty disrespectful the way the forensic regulator talks about digital forensics and bluntly doesn't really seem to understand the field very well (if at all).

Perhaps then band together as FF contributors using each of our own skillsets to produce our own Digital Forensics Field Guidelines containing real-world experience. 

Also, they don't know how hidden volumes of TrueCrypt work: https://twitter.com/errno_fail/status/1278694882853486592