RnD

Digital Evidence: Standards and Principles Proposed Standards for the Exchange of Digital Evidence   Scientific Working Group on Digital Evidence (SWGDE) Introduction The Scientific Working Group on Digital Evidence (SWGDE) was established in February 1998 through a collaborative effort of the Federal Crime Laboratory Directors. SWGDE, as the U.S.-based component of standardization efforts conducted by the International Organization on Computer Evidence (IOCE), was charged with the development of cross-disciplinary guidelines and standards for the recovery, preservation, and examination of digital evidence, including audio, imaging, and electronic devices. The following document was drafted by SWGDE and presented at the International Hi-Tech Crime and Forensics Conference (IHCFC) held in London, United Kingdom, October 4-7, 1999. It proposes the establishment of standards for the exchange of digital evidence between sovereign nations and is intended to elicit con...

ISO/IEC 27000-series ISO/IEC 27000  — Information security management systems — Overview and vocabulary [9] ISO/IEC 27001  — Information technology - Security Techniques - Information security management systems — Requirements. The 2013 release of the standard specifies an information security management system in the same formalized, structured and succinct manner as other ISO standards specify other kinds of management systems. ISO/IEC 27002  — Code of practice for information security controls - essentially a detailed catalog of information security controls that might be managed through the ISMS ISO/IEC 27003 — Information security management system implementation guidance ISO/IEC 27004 — Information security management — Monitoring, measurement, analysis and evaluation [10] ISO/IEC 27005 — Information security risk management [11] ISO/IEC 27006 — Requirements for bodies providing audit and certification of information security management systems ISO/...

Digital Forensics Life Cycle Evidence Acquisition Forensically sound disk images are files containing the structure and contents of a disk storage device or a volume from sources such as solid state disks, optical disc or USB flash drive. A court admissible forensic physical disk image is a sector-by-sector copy of a medium where a digital fingerprint (aka “hash value”) was calculated during the acquisition process, and the imaging process did not alter the source medium. With the hash value in hand, copies of the images can be provided for litigation purposes and the integrity can be verified by rerunning the digital fingerprint and comparing hash values. Evidence Analysis This function involves the interpretation of the collected information in order to find artifacts supporting the case particulars. The analysis may be centered on file and application access times; identification of destroyed documents, and misappropriation of intellectual pr...