ASTM E3016-15e1
(Guide)Standard Guide for Establishing Confidence in Digital Forensic Results by Error Mitigation Analysis
Standard Guide for Establishing Confidence in Digital Forensic Results by Error Mitigation Analysis
SIGNIFICANCE AND USE
3.1 Digital forensics is a complex field that is heavily reliant on algorithms that are embedded in automated tools and used to process evidence. Weaknesses or errors in these algorithms, tools, and processes can potentially lead to incorrect findings. Indeed, errors have occurred in a variety of contexts, demonstrating the need for more scientific rigor in digital forensics. This guide proposes a disciplined approach to mitigating potential errors in evidence processing to reduce the risk of inaccuracies, oversights, or misinterpretations in digital forensics. This approach provides a scientific basis for confidence in digital forensic results.
3.2 Error rates are used across the sciences to explain the amount of uncertainty or the limitation of a given result. The goal is to explain to the reader (or receiver of the result) the confidence the provider of the result has that it is correct. Many forensic disciplines use error rates as a part of how they communicate their results. Similarly, digital forensics needs to communicate how and why there is confidence in the results. Because of intrinsic difference between the biological and chemical sciences and computer science, it is necessary to go beyond error rates. One difference between chemistry and computer science is that digital technology is constantly changing and individuals put their computers to unique uses, making it infeasible to develop a representative sample to use for error rate calculations. Furthermore, a digital forensic method may work well in one environment but fail completely in a different environment.
3.3 This document provides a disciplined and structured approach for addressing and explaining potential errors and error rates associated with the use of digital forensic tools/processes in any given environment. This approach to establishing confidence in digital forensic results addresses Daubert considerations.
SCOPE
1.1 This guide provides a process for recognizing and describing both errors and limitations associated with tools used to support digital forensics. This is accomplished by explaining how the concepts of errors and error rates should be addressed in digital forensics. It is important for practitioners and stakeholders to understand that digital forensic techniques and tools have known limitations, but those limitations have differences from errors and error rates in other forensic disciplines. This guide proposes that confidence in digital forensic results is best achieved by using an error mitigation analysis approach that focuses on recognizing potential sources of error and then applying techniques used to mitigating them, including trained and competent personnel using tested and validated methods and practices.
General Information
Relations
Buy Standard
Standards Content (Sample)
NOTICE: This standard has either been superseded and replaced by a new version or withdrawn.
Contact ASTM International (www.astm.org) for the latest information
´1
Designation:E3016 −15
Standard Guide for
Establishing Confidence in Digital Forensic Results by Error
1
Mitigation Analysis
This standard is issued under the fixed designation E3016; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision.Anumber in parentheses indicates the year of last reapproval.A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1
ε NOTE—Editorial changes were made throughout in September 2016.
1. Scope tools, and processes can potentially lead to incorrect findings.
Indeed, errors have occurred in a variety of contexts, demon-
1.1 This guide provides a process for recognizing and
strating the need for more scientific rigor in digital forensics.
describing both errors and limitations associated with tools
This guide proposes a disciplined approach to mitigating
used to support digital forensics. This is accomplished by
potential errors in evidence processing to reduce the risk of
explaininghowtheconceptsoferrorsanderrorratesshouldbe
inaccuracies, oversights, or misinterpretations in digital foren-
addressed in digital forensics. It is important for practitioners
sics.Thisapproachprovidesascientificbasisforconfidencein
and stakeholders to understand that digital forensic techniques
digital forensic results.
and tools have known limitations, but those limitations have
differences from errors and error rates in other forensic 3.2 Error rates are used across the sciences to explain the
disciplines. This guide proposes that confidence in digital
amount of uncertainty or the limitation of a given result. The
forensic results is best achieved by using an error mitigation goal is to explain to the reader (or receiver of the result) the
analysisapproachthatfocusesonrecognizingpotentialsources
confidencetheprovideroftheresulthasthatitiscorrect.Many
of error and then applying techniques used to mitigating them, forensic disciplines use error rates as a part of how they
including trained and competent personnel using tested and
communicate their results. Similarly, digital forensics needs to
validated methods and practices. communicate how and why there is confidence in the results.
Because of intrinsic difference between the biological and
2. Referenced Documents
chemical sciences and computer science, it is necessary to go
2
beyond error rates. One difference between chemistry and
2.1 ISO Standard:
ISO/IEC 17025General Requirements for the Competence computer science is that digital technology is constantly
changing and individuals put their computers to unique uses,
of Testing and Measurement Laboratories
3
making it infeasible to develop a representative sample to use
2.2 SWGDE Standards:
for error rate calculations. Furthermore, a digital forensic
SWGDE Model Quality Assurance Manualfor Digital Evi-
dence method may work well in one environment but fail completely
in a different environment.
SWGDE Standards and ControlsPosition Paper
SWGDE/SWGIT Proficiency TestProgram Guidelines
3.3 This document provides a disciplined and structured
SWGDE/SWGIT Guidelines & Recommendations for
approach for addressing and explaining potential errors and
Training in Digital & Multimedia Evidence
error rates associated with the use of digital forensic tools/
processes in any given environment. This approach to estab-
3. Significance and Use
lishingconfidenceindigitalforensicresultsaddresses Daubert
3.1 Digitalforensicsisacomplexfieldthatisheavilyreliant
considerations.
on algorithms that are embedded in automated tools and used
to process evidence. Weaknesses or errors in these algorithms,
4. Background
4.1 Digital forensic practitioners are confident in the ability
1
This guide is under the jurisdiction of ASTM Committee E30 on Forensic
of their methods and tools to produce reliable conclusions;
Sciences and is the direct responsibility of Subcommittee E30.12 on Digital and
however, they often struggle to establish their confidence on a
Multimedia Evidence.
scientific basis. Some forensic disciplines use an error rate to
Current edition approved May 1, 2015. Published June 2015. DOI: 10.1520/
E3016-15E01.
describe the chance of false positives, false negatives, or
2
Available fromAmerican National Standards Institute (ANSI), 25 W. 43rd St.,
otherwise inaccurate results when determining whether two
4th Floor, New York, NY 10036, http://www.ansi.org.
3
samples actually come from the same source. But in digital
Available from the Scientific Working Group on Digital Evidence (SWDGE),
https://www.swgde.org. forensics, there are fundamental differences in the nature of
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959. United States
1
---------------------- Page: 1 ----------------------
...
This document is not an ASTM standard and is intended only to provide the user of an ASTM standard an indication of what changes have been made to the previous version. Because
it may not be technically possible to adequately depict all changes accurately, ASTM recommends that users consult prior editions as appropriate. In all cases only the current version
of the standard as published by ASTM is to be considered the official document.
´1
Designation: E3016 − 15 E3016 − 15
Standard Guide for
Establishing Confidence in Digital Forensic Results by Error
1
Mitigation Analysis
This standard is issued under the fixed designation E3016; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1
ε NOTE—Editorial changes were made throughout in September 2016.
1. Scope
1.1 This guide provides a process for recognizing and describing both errors and limitations associated with tools used to
support digital forensics. This is accomplished by explaining how the concepts of errors and error rates should be addressed in
digital forensics. It is important for practitioners and stakeholders to understand that digital forensic techniques and tools have
known limitations, but those limitations have differences from errors and error rates in other forensic disciplines. This guide
proposes that confidence in digital forensic results is best achieved by using an error mitigation analysis approach that focuses on
recognizing potential sources of error and then applying techniques used to mitigating them, including trained and competent
personnel using tested and validated methods and practices.
2. Referenced Documents
2
2.1 ISO Standard:
ISO/IEC 17025 General Requirements for the Competence of Testing and Measurement Laboratories
3
2.2 SWGDE Standards:
SWGDE Model Quality Assurance Manual for Digital Evidence
SWGDE Standards and Controls Position Paper
SWGDE/SWGIT Proficiency Test Program Guidelines
SWGDE/SWGIT Guidelines & Recommendations for Training in Digital & Multimedia Evidence
3. Significance and Use
3.1 Digital forensics is a complex field that is heavily reliant on algorithms that are embedded in automated tools and used to
process evidence. Weaknesses or errors in these algorithms, tools, and processes can potentially lead to incorrect findings. Indeed,
errors have occurred in a variety of contexts, demonstrating the need for more scientific rigor in digital forensics. This guide
proposes a disciplined approach to mitigating potential errors in evidence processing to reduce the risk of inaccuracies, oversights,
or misinterpretations in digital forensics. This approach provides a scientific basis for confidence in digital forensic results.
3.2 Error rates are used across the sciences to explain the amount of uncertainty or the limitation of a given result. The goal
is to explain to the reader (or receiver of the result) the confidence the provider of the result has that it is correct. Many forensic
disciplines use error rates as a part of how they communicate their results. Similarly, digital forensics needs to communicate how
and why there is confidence in the results. Because of intrinsic difference between the biological and chemical sciences and
computer science, it is necessary to go beyond error rates. One difference between chemistry and computer science is that digital
technology is constantly changing and individuals put their computers to unique uses, making it infeasible to develop a
representative sample to use for error rate calculations. Furthermore, a digital forensic method may work well in one environment
but fail completely in a different environment.
3.3 This document provides a disciplined and structured approach for addressing and explaining potential errors and error rates
associated with the use of digital forensic tools/processes in any given environment. This approach to establishing confidence in
digital forensic results addresses Daubert considerations.
1
This guide is under the jurisdiction of ASTM Committee E30 on Forensic Sciences and is the direct responsibility of Subcommittee E30.12 on Digital and Multimedia
Evidence.
Current edition approved May 1, 2015. Published June 2015. DOI: 10.1520/E3016-15.10.1520/E3016-15E01.
2
Available from American National Standards Institute (ANSI), 25 W. 43rd St., 4th Floor, New York, NY 10036, http://www.ansi.org.
3
Available from the Scientific Working Group on Digital Evidence (SWDGE), https://www.swgde.org.
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959. United States
1
---------------------- Page: 1 ----------------------
´1
E3016 − 15
4. Background
4.1 Digital forensic practitioners are confident in the ability of their methods and tools to produce reliable concl
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.