ASTM E2763-10
(Practice)Standard Practice for Computer Forensics (Withdrawn 2019)
Standard Practice for Computer Forensics (Withdrawn 2019)
SIGNIFICANCE AND USE
The purpose of this practice is to describe techniques and procedures for computer forensics in regard to evidence handling, computers, digital imaging, and forensic analysis and examination.
The examiner should be trained in accordance with Guide E2678.
Individuals not trained in proper digital evidence procedures should consult with an appropriate specialist before proceeding.
When dealing with technology outside your area of expertise, consult with an appropriate specialist before proceeding.
SCOPE
1.1 This practice describes techniques and procedures for computer forensics within the context of a criminal investigation.
1.1.1 This practice can be applicable to civil litigation.
1.2 This practice describes seizing possible evidence, proper evidence handling, digital imaging, forensic analysis/examination, evidence-handling documentation, and reporting.
1.3 This practice is not all inclusive and does not contain information relative to specific operating systems or forensic tools.
1.4 The values stated in SI units are to be regarded as standard. No other units of measurement are included in this standard.
1.5 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety and health practices and determine the applicability of regulatory limitations prior to use.
WITHDRAWN RATIONALE
This practice describes techniques and procedures for computer forensics within the context of a criminal investigation.
Formerly under the jurisdiction of Committee E30 on Forensic Sciences, this practice was withdrawn in January 2019 in accordance with section 10.6.3 of the Regulations Governing ASTM Technical Committees, which requires that standards shall be updated by the end of the eighth year since the last approval date.
General Information
Relations
Standards Content (Sample)
NOTICE: This standard has either been superseded and replaced by a new version or withdrawn.
Contact ASTM International (www.astm.org) for the latest information
Designation: E2763 − 10
Standard Practice for
1
Computer Forensics
This standard is issued under the fixed designation E2763; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope 3.2 The examiner should be trained in accordance with
Guide E2678.
1.1 This practice describes techniques and procedures for
computer forensics within the context of a criminal investiga- 3.3 Individuals not trained in proper digital evidence proce-
tion.
dures should consult with an appropriate specialist before
1.1.1 This practice can be applicable to civil litigation. proceeding.
1.2 This practice describes seizing possible evidence,
3.4 When dealing with technology outside your area of
proper evidence handling, digital imaging, forensic analysis/
expertise, consult with an appropriate specialist before pro-
examination, evidence-handling documentation, and reporting.
ceeding.
1.3 This practice is not all inclusive and does not contain
4. Seizing Evidence
information relative to specific operating systems or forensic
tools.
4.1 General guidelines concerning the seizing of evidence
are:
1.4 The values stated in SI units are to be regarded as
4.1.1 Consult with the investigator or responsible party to
standard. No other units of measurement are included in this
determine the necessary equipment to take to the scene.
standard.
4.1.2 Review the legal authority to seize the evidence,
1.5 This standard does not purport to address all of the
ensuring any restrictions are noted. If necessary during the
safety concerns, if any, associated with its use. It is the
execution of the seizure, obtain additional authority for evi-
responsibility of the user of this standard to establish appro-
dence outside the scope of the search.
priate safety and health practices and determine the applica-
4.1.3 When it is impractical to remove the evidence from
bility of regulatory limitations prior to use.
the scene, the evidence items shall be copied or imaged
according to organizational policy.
2. Referenced Documents
2 4.1.4 All suspects, witnesses, and bystanders shall be re-
2.1 ASTM Standards:
moved from the proximity of digital evidence to ensure the
E2678 Guide for Education and Training in Computer Fo-
integrity of potential evidence.
rensics
3 4.1.5 Solicit information from potential suspects, witnesses,
2.2 SWGDE Standards:
system administrators, and so forth, to ascertain knowledge of
Recommended Guidelines for Validation Testing
the systems to be seized (for example, password(s), operating
system(s), screen names, remote access users, and E-mail
3. Significance and Use
addresses).
3.1 The purpose of this practice is to describe techniques
4.1.6 The scene shall be searched systematically and thor-
and procedures for computer forensics in regard to evidence
oughlyforevidence.Searchersshallbetrainedtorecognizethe
handling,computers,digitalimaging,andforensicanalysisand
different types of evidence. Check for additional media that
examination.
may be attached to the computer system.
1
This practice is under the jurisdiction of ASTM Committee E30 on Forensic
5. Evidence Handling
Sciences and is the direct responsibility of Subcommittee E30.12 on Digital and
5.1 Document the scene, which can include: taking clear,
Multimedia Evidence.
Current edition approved Aug. 15, 2010. Published September 2010. DOI:
detailed photographs (of the computer screen, of the front and
10.1520/E2763-10.
back of the computer, and of the area around the computer to
2
For referenced ASTM standards, visit the ASTM website, www.astm.org, or
be seized) and making a sketch/notation of the computer
contact ASTM Customer Service at service@astm.org. For Annual Book of ASTM
Standards volume information, refer to the standard’s Document Summary page on connections and surrounding area, or both.
the ASTM website.
3
5.2 If the computer is turned off, DO NOT turn on the
Available from Scientific Working Group on Digital Evidence (SWGDE),
http://www.swgde.org/documents. computer.
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959. United States
1
---------------------- Page: 1 ----------------------
E2763 − 10
5.2.1 Before powering down a computer, consider the 6.1.1 Equipment shall be monitored and documented to
potential of encryption software being installed on the com- ensure proper performance is maintained.
puter or as part of the operating system. If present, appropriate 6.1.2 Only suitable and properly operating equipment shall
forensic methods should be used to capture the unencrypted be used.
data and any volati
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.