ASTM E3017-19

Standard Practice for Examining Magnetic Card Readers

SIGNIFICANCE AND USE
4.1 As a skimming device is not typically deemed contraband in of itself, it is the responsibility of the examiner to determine if the device contains unauthorized account information. The purpose of this practice is to describe best practices for seizing, acquiring, and analyzing the data contained within magnetic card readers.  
4.2 Limitations—Skimmers present unique examination challenges due to:  
4.2.1 Rapid changes in technology;  
4.2.2 Difficulty of device disassembly;  
4.2.3 Use of alternate/repurposed components;  
4.2.4 Use of encryption or examination countermeasures, or both;  
4.2.5 Multiple data encoding/modulation formats;  
4.2.6 Prevention of chip identification by obfuscation of the device;  
4.2.7 Availability of training and documentation;  
4.2.8 Lack of chip information/documentation;  
4.2.9 Lack of adapters available for chip reading;  
4.2.10 Expense of available equipment used in chip removal and reading;  
4.2.11 Lack of software’s ability to support reading chip data; and  
4.2.12 Lack of commercial software available to analyze encrypted data extracted from skimmers.
SCOPE
1.1 Magnetic card readers, when used for illegal purposes, are commonly referred to as skimmers. This practice provides information on seizing, acquiring, and analyzing skimming devices capable of acquiring and storing personally identifiable information (PII) in an unauthorized manner.  
1.2 This standard cannot replace knowledge, skills, or abilities acquired through education, training, and experience and is to be used in conjunction with professional judgment by individuals with such discipline-specific knowledge, skills, and abilities.  
1.3 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.4 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

General Information

• Status: Published
• Publication Date: 31-May-2019
• ICS: 35.240.15 - Identification cards. Chip cards. Biometrics
• Technical Committee: E30 - Forensic Sciences
• Drafting Committee: E30.12 - Digital and Multimedia Evidence

Relations

• Refers: ASTM E2916-18 - Standard Terminology for Digital and Multimedia Evidence Examination
• Effective Date: 01-Nov-2018
• Refers: ASTM E2916-19 - Standard Terminology for Digital and Multimedia Evidence Examination
• Effective Date: 01-Mar-2019

Standards Content (Sample)

This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the
Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.
Designation: E3017 − 19 An American National Standard
Standard Practice for
1
Examining Magnetic Card Readers
This standard is issued under the fixed designation E3017; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision.Anumber in parentheses indicates the year of last reapproval.A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope ISO/IEC 7812-1:2017Identification Cards—Identification
of Issuers—Part 1: Numbering SSystem
1.1 Magnetic card readers, when used for illegal purposes,
ISO/IEC 7813:2006 Information Technology—
are commonly referred to as skimmers. This practice provides
Identification Cards—Financial Transaction Cards
information on seizing, acquiring, and analyzing skimming
5
2.3 SWGDE Standards:
devicescapableofacquiringandstoringpersonallyidentifiable
information (PII) in an unauthorized manner. SWGDE Best Practices for Chip-Off
SWGDE Best Practices for Computer Forensics
1.2 This standard cannot replace knowledge, skills, or
SWGDE Recommendations for Validation Testing
abilities acquired through education, training, and experience
SWGDE Tech Notes Regarding Chip-Off via Material Re-
and is to be used in conjunction with professional judgment by
moval Using a Lap and Polish Process
individuals with such discipline-specific knowledge, skills, and
6
2.4 ANSI Standards:
abilities.
ANSI X4.16 Financial Services—Financial Transaction
1.3 This standard does not purport to address all of the
Cards—Magnetic Stripe Encoding
safety concerns, if any, associated with its use. It is the
responsibility of the user of this standard to establish appro-
3. Terminology
priate safety, health, and environmental practices and deter-
3.1 Definitions:
mine the applicability of regulatory limitations prior to use.
3.1.1 For definitions of terms used in this practice, refer to
1.4 This international standard was developed in accor-
Terminology E2916.
dance with internationally recognized principles on standard-
ization established in the Decision on Principles for the
3.2 Definitions of Terms Specific to This Standard:
Development of International Standards, Guides and Recom-
3.2.1 parasitic skimmer, n—a type of device manufactured
mendations issued by the World Trade Organization Technical
for the capture of account data from magnetically encoded
Barriers to Trade (TBT) Committee.
cardsthatoperatesin-linewiththeoriginalATM,gaspump,or
other card reading device.
2. Referenced Documents
3.2.2 start sentinel, n—a 5-bit binary sequence, or equiva-
2
2.1 ASTM Standards:
lent ASCII character, used to signify the beginning of track
3
E2763Practice for Computer Forensics (Withdrawn 2019)
data. (See ISO/IEC 7813:2006.)
E2916Terminology for Digital and Multimedia Evidence
3.2.3 skimmer, n—a magnetic card reader, specifically when
Examination
used for an illegal purpose.
4
2.2 ISO Standards:
3.2.4 skimming, n—using a skimmer to acquire PII in an
ISO/IEC 7811Identification Cards—Recording Technique
unauthorized manner.
3.2.5 swipe, v—to manually pass a magnetically encoded
1
This practice is under the jurisdiction of ASTM Committee E30 on Forensic
card through a card reader device to transfer information from
Sciences and is the direct responsibility of Subcommittee E30.12 on Digital and
the card.
Multimedia Evidence.
Current edition approved June 1, 2019. Published June 2019. Originally
3.3 Acronyms:
approved in 2015. Last previous edition approved as E3017 – 15. DOI: 10.1520/
3.3.1 ADPCM, n—adaptive pulse code modulation
E3017-19.
2
For referenced ASTM standards, visit the ASTM website, www.astm.org, or 3.3.2 AES, n—advanced encryption standard
contact ASTM Customer Service at [e-mail]. For Annual Book of ASTM
Standards volume information, refer to the standard’s Document Summary page on
the ASTM website.
3 5
The last approved version of this historical standard is referenced on Available from the Scientific Working Group on Digital Evidence (SWDGE),
www.astm.org. https://www.swgde.org.
4 6
Available from National Institute of Standards and Technology (NIST), 100 Available fromAmerican National Standards Institute (ANSI), 25 W. 43rd St.,
Bureau Dr., Stop 1070, Gaithersburg, MD 20899-1070, http://www.nist.gov. 4th Floor, New York, NY 10036, http://www.ansi.org.
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959. United States
1

---------------------- Page: 1 ----------------------
E3017 − 19
4. Significance and Use
4.1 As a skimming device is not typically deemed contra-
band in of itself, it is the responsibility of the exami
...

This document is not an ASTM standard and is intended only to provide the user of an ASTM standard an indication of what changes have been made to the previous version. Because
it may not be technically possible to adequately depict all changes accurately, ASTM recommends that users consult prior editions as appropriate. In all cases only the current version
of the standard as published by ASTM is to be considered the official document.
Designation: E3017 − 15 E3017 − 19
Standard Practice for
1
Examining Magnetic Card Readers
This standard is issued under the fixed designation E3017; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope
1.1 Magnetic card readers, when used for illegal purposes, are commonly referred to as skimmers. This practice provides
information on seizing, acquiring, and analyzing skimming devices capable of acquiring and storing personally identifiable
information (PII) in an unauthorized manner.
1.2 This standard cannot replace knowledge, skills, or abilities acquired through education, training, and experience and is to
be used in conjunction with professional judgment by individuals with such discipline-specific knowledge, skills, and abilities.
1.3 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility
of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of
regulatory limitations prior to use.
1.4 This international standard was developed in accordance with internationally recognized principles on standardization
established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued
by the World Trade Organization Technical Barriers to Trade (TBT) Committee.
2. Referenced Documents
2
2.1 ASTM Standards:
3
E2763 Practice for Computer Forensics (Withdrawn 2019)
E2916 Terminology for Digital and Multimedia Evidence Examination
4
2.2 ISO Standards:
ISO/IEC 7811 Identification Cards—Recording Technique
ISO/IEC 78127812-1:2017 Identification Cards—Identification of IssuersIssuers—Part 1: Numbering SSystem
ISO/IEC 78137813:2006 Information Technology—Identification Cards—Financial Transaction Cards
5
2.3 SWGDE Standards:
SWGDE Best Practices for Chip-Off
SWGDE Best Practices for Computer Forensics for Computer Forensics
SWGDE Recommendations for Validation Testing for Validation Testing
SWGDE Tech Notes Regarding Chip-Off via Material Removal Using a Lap and Polish Process
6
2.4 ANSI Standards:
ANSI X4.16 Financial Services—Financial Transaction Cards—Magnetic Stripe Encoding
3. Terminology
3.1 Definitions:
3.1.1 For definitions of terms used in this practice, refer to Terminology E2916.
3.2 Definitions of Terms Specific to This Standard:
1
This practice is under the jurisdiction of ASTM Committee E30 on Forensic Sciences and is the direct responsibility of Subcommittee E30.12 on Digital and Multimedia
Evidence.
Current edition approved May 1, 2015June 1, 2019. Published June 2015June 2019. Originally approved in 2015. Last previous edition approved as E3017 – 15. DOI:
10.1520/E3017-15.10.1520/E3017-19.
2
For referenced ASTM standards, visit the ASTM website, www.astm.org, or contact ASTM Customer Service at [e-mail]. For Annual Book of ASTM Standards
volume information, refer to the standard’s Document Summary page on the ASTM website.
3
The last approved version of this historical standard is referenced on www.astm.org.
4
Available from National Institute of Standards and Technology (NIST), 100 Bureau Dr., Stop 1070, Gaithersburg, MD 20899-1070, http://www.nist.gov.
5
Available from the Scientific Working Group on Digital Evidence (SWDGE), https://www.swgde.org.
6
Available from American National Standards Institute (ANSI), 25 W. 43rd St., 4th Floor, New York, NY 10036, http://www.ansi.org.
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959. United States
1

---------------------- Page: 1 ----------------------
E3017 − 19
FIG. 1 Example of a Hand-Held Skimmer
3.2.1 parasitic skimmer, n—a type of device manufactured for the capture of account data from magnetically encoded cards that
operates in-line with the original ATM, gas pump, or other card reading device.
3.2.2 start sentinel, n—a 5-bit binary sequence, or equivalent ASCII character, used to signify the beginning of track data. (See
ISO/IEC 7813).7813:2006.)
3.2.3 skimmer, n—a magnetic card reader, specifically when used for an illegal purpose.
3.2.4 skimming, n—using a skimmer to acquire PII in an unauthorized manner.
3.2.5 swipe, v—to manually pass a magnetically encoded card through a card reader device to transfer information
...