HI~
I am South Korea Digital Forensic Investigator.
I feel necessity that must reappraise about analysis result.
So, use a forensic tool more than 2(encase, ftk…)
Or, trust that analysis result that more than 2 investigator is same.
How do you review phase?
Reproducibility of the analysis of digital evidence depends on the type of investigation involved and depending upon the problem the tools are to be selected for analysis. For LE organizations one must use validated tools.
It is also possible to implement the management system as per the ISO/IEC170252005 standards for validation of results by testing the reprodubility and other acpects which will help you to develope the SOPs. Further you may participate in the proficiency testing in digital forensics.
You should not take the results of the software you are using without manually validating some of the results. Check to see, for example what was reported by Encase, FTK etc is actually on the disk using tools such as a hex editor etc.
Alan