ASTM E2678-09
(Guide)Standard Guide for Education and Training in Computer Forensics
Standard Guide for Education and Training in Computer Forensics
SIGNIFICANCE AND USE
With the proliferation of computers and other electronic devices, it is difficult to imagine a crime that could not potentially involve digital evidence. Because of the paucity of degree programs in computer forensics, practitioners have historically relied on practical training through law enforcement or vendor-specific programs or both.
In this guide, curricula for different levels of the educational system are outlined. It is intended to provide guidance to:
Individuals interested in pursuing academic programs and professional opportunities in computer forensics,
Academic institutions interested in developing computer forensics programs, and
Employers seeking information about the educational background of graduates of computer forensics programs and evaluating continuing education opportunities for current employees.
SCOPE
1.1 This guide will improve and advance computer forensics through the development of model curricula consistent with other forensic science programs.
1.2 Section 4 describes the alternative paths by which students may arrive at and move through their professional training. Sections 5 through 7 cover formal educational programs in order of increasing length: a two- year associate degree, a four-year baccalaureate degree, and graduate degrees. Section 8 provides a framework for academic certificate programs offered by educational institutions. Section 9 outlines model criteria and implementation approaches for training and continuing education opportunities provided by professional organizations, vendors, and academic institutions.
1.3 Some professional organizations recognize computer forensics, forensic audio, video, and image analysis as subdisciplines of computer forensics. However, the curricula and specific educational training requirements of subdisciplines other than computer forensics are beyond the scope of this guide.
1.4 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety and health practices and determine the applicability of regulatory limitations prior to use.
General Information
Relations
Standards Content (Sample)
NOTICE: This standard has either been superseded and replaced by a new version or withdrawn.
Contact ASTM International (www.astm.org) for the latest information
Designation: E2678 − 09
StandardGuide for
Education and Training in Computer Forensics
This standard is issued under the fixed designation E2678; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope 2.1.4 compiler, n—software that translates a high- level
program into a form that can be executed by a computer.
1.1 This guide will improve and advance computer foren-
2.1.5 digital forensics, n—science of identifying, collecting,
sics through the development of model curricula consistent
preserving, documenting, examining, and analyzing evidence
with other forensic science programs.
from computer systems, the results of which may be relied
1.2 Section 4 describes the alternative paths by which
upon in court.
students may arrive at and move through their professional
2.1.6 cryptography, n—using the sciences of encryption to
training. Sections 5 through 7 cover formal educational pro-
transformdatatohideitsinformationcontentanddecryptionto
grams in order of increasing length: a two- year associate
restore the information to its original form.
degree,afour-yearbaccalaureatedegree,andgraduatedegrees.
Section 8 provides a framework for academic certificate
2.1.7 datafusion,n—processofassociating,correlating,and
programsofferedbyeducationalinstitutions.Section9outlines
combining data and information from single and multiple
model criteria and implementation approaches for training and
sources.
continuing education opportunities provided by professional
2.1.8 debugger, n—software that is used to find faults in
organizations, vendors, and academic institutions.
programs.
1.3 Some professional organizations recognize computer
2.1.9 demultiplexing, v—process of isolating individual im-
forensics, forensic audio, video, and image analysis as subdis-
ages from a video flow.
ciplines of computer forensics. However, the curricula and
2.1.10 digital evidence, n—information of probative value
specific educational training requirements of subdisciplines
that is stored or transmitted in binary form that may be relied
other than computer forensics are beyond the scope of this
upon in court.
guide.
2.1.11 computer forensics, n—science of identifying,
1.4 This standard does not purport to address all of the
collecting, preserving, documenting, examining, and analyzing
safety concerns, if any, associated with its use. It is the
evidence from computer systems, networks, and other elec-
responsibility of the user of this standard to establish appro-
tronicdevices,theresultsofwhichmayberelieduponincourt.
priate safety and health practices and determine the applica-
2.1.12 distributed denial of service (DDoS), n—intentional
bility of regulatory limitations prior to use.
paralyzing of a computer or a computer network by flooding it
with data sent simultaneously from many locations.
2. Terminology
2.1.13 Electronic Communications Privacy Act (ECPA),
2.1 Definitions of Terms Specific to This Standard:
n—regulates interception of wire and electronic communica-
2.1.1 assembler, n—software that translates a low-level
tions (18 USC §2510 et seq.) and retrieval of stored wire and
program into a form that can be executed by a computer.
electronic communications (18 USC §2701 et seq.)
2.1.2 capstone project, n—design and implementation-
2.1.14 embedded device, n—special-purpose computer sys-
oriented project typically completed during the final year of a
tem that is completely encapsulated by the device it controls.
degree program that requires students to apply and integrate
knowledge and skills gained from several courses. 2.1.15 enterprise system, n—computer systems or networks
or both integral to the operation of a company or large entity,
2.1.3 central processing unit (CPU), n—computer chip that
possibly global in scope.
interprets commands and runs programs.
2.1.16 ext2/ext3 (Linux-extended 2/Linux-extended 3) file
system, n—file system typically used with Linux-based oper-
ating systems.
This guide is under the jurisdiction of ASTM Committee E30 on Forensic
Sciences and is the direct responsibility of Subcommittee E30.12 on Digital and
2.1.17 file allocation table (FAT) file system, n—original file
Multimedia Evidence.
system used with Microsoft and IBM-compatible operating
Current edition approved June 15, 2009. Published August 2009. DOI: 10.1520/
E2678-09. systems still in common use.
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959. United States
E2678 − 09
2.1.18 intrusion detection system (IDS), n—software or 2.1.36 virtual private network (VPN), n—computer network
hardware that are used to identify attacks or anomalies on that uses encryption to transmit data in a secure fashion over a
computers or networks or both. public network.
2.1.37 voice over internet protocol (VoIP), n—technique for
2.1.19 link analysis, n—type of analysis often used by law
transmitting real-time voice communications over the internet
enforcement that uses visual or other means of showing
or another transmission control protocol/internet protocol
relationships between people, places, events, and things by
(TCP/IP) network.
linking them through timelines, telephone calls, emails, or any
other consistent scheme.
2.1.38 wide-area network (WAN), n—computer network
covering a wide geographical area.
2.1.20 local area network (LAN), n—computer network
covering a local area such as a home, office, or small group of
2.2 Acronyms:
buildings, such as a college.
2.2.1 FDA, n—Food and Drug Administration
2.1.21 malware, n—malicious software designed to cause
2.2.2 FTC, n—Federal Trade Commission
unexpected and frequently undesirable actions on a system (for
2.2.3 IP, n—internet protocol
example, viruses, worms, spyware, or Trojan horses).
2.2.4 IRS, n—Internal Revenue Service
2.1.22 mock trial, n—often referred to as “moot court,”
2.2.5 KSA, n—knowledge, skill, and ability
role-playing court proceedings intended to prepare students for
2.2.6 SEC, n—Securities and Exchange Commission
courtroom testimony.
2.2.7 TCP, n—transmission control protocol
2.1.23 new technology file system (NTFS), n—advanced file
system with security features commonly used with the Win-
3. Significance and Use
dows and all subsequent sytems.
3.1 With the proliferation of computers and other electronic
2.1.24 open system interconnect (OSI), n—layered model
devices, it is difficult to imagine a crime that could not
that describes the way computers communicate on a network.
potentially involve digital evidence. Because of the paucity of
2.1.25 personalareanetwork(PAN),n—networkingscheme
degree programs in computer forensics, practitioners have
that enables computers and other electronic devices to com-
historically relied on practical training through law enforce-
municate with each other over short distances either with or
ment or vendor-specific programs or both.
without wires.
3.2 In this guide, curricula for different levels of the
2.1.26 partitioning,v—softwaremethodofdividingaphysi-
educational system are outlined. It is intended to provide
cal hard drive into logical containers that will appear as
guidance to:
multiple logical drives.
3.2.1 Individuals interested in pursuing academic programs
and professional opportunities in computer forensics,
2.1.27 peer to peer (P2P), n—communications network that
3.2.2 Academic institutions interested in developing com-
allows multiple computers to share files.
puter forensics programs, and
2.1.28 personal electronic device (PED), n—consumerelec-
3.2.3 Employers seeking information about the educational
tronic device that is typically mobile or handheld (for example,
background of graduates of computer forensics programs and
personal digital assistant (PDA), cell phone, or iPOD).
evaluating continuing education opportunities for current em-
2.1.29 photogrammetry, n—science of obtaining dimen- ployees.
sional information of items depicted in photographs.
4. Qualifications for a Career in Computer Forensics
2.1.30 public key infrastructure (PKI), n—system that uses
4.1 Introduction:
encryption to verify and authenticate network transactions.
4.1.1 Computer forensics plays a fundamental role in the
2.1.31 random access memory (RAM), n—computer’s read/
investigation and prosecution of crimes. Since any type of
write memory; it provides temporary memory space for the
criminal activity may involve the seizure and examination of
computer to process data.
digital evidence, the percentage of cases that involves digital
2.1.32 redundant array of inexpensive/independent disks evidence will continue to increase. The preservation, examina-
(RAID),n—systemthatusestwoormoredrivesincombination
tion, and analysis of digital evidence require a foundation in
for fault tolerance or performance. the practical application of science, computer technology, and
the law. A practitioner of computer forensics shall be capable
2.1.33 steganography, n—technique for embedding infor-
of integrating knowledge, skills, and abilities in the identifica-
mation into something else, such as a text file in an image or a
tion, preservation, documentation, examination, analysis, inter-
sound file, for the sole purpose of hiding the existence of the
pretation, reporting, and testimonial support of digital evi-
embedded information.
dence. A combination of education and practical training can
2.1.34 thumb drive, n—smalldigitalstoragedevicethatuses
prepare an individual for a career in computer forensics, and
flash memory and a universal serial bus (USB) connection to
this section addresses the qualifications an individual will need
interface with a computer.
to pursue such a career.
2.1.35 topology, n—physical layout or logical operation of a 4.1.2 As in all forensic disciplines, a combination of per-
network. sonal, technical, and professional criteria will influence a
E2678 − 09
prospective computer forensics practitioner’s suitability for strengthen the academic requirements for this discipline and
employment. Effective written and oral communication skills require a baccalaureate degree, preferably in a science. The
are essential to computer forensics practitioners because they academic qualifications for computer forensics practitioners
may have to testify to their examination results in court. New are discussed in greater detail later in this guide and may
employees may be hired provisionally or go through a proba- include the following knowledge, skills, and abilities:
tionaryperiodthatrequiressuccessfulcompletionofadditional
4.2.5.1 Technical:
training or competency testing or both as a prerequisite for
(1) Computer hardware and architecture
continued employment.
(2) Storage media
(3) Operating systems
4.2 Career Paths in Computer Forensics:
(4) File systems
4.2.1 Numerous competent, accurate, and admissible digital
(5) Database systems
forensic examinations are performed every year by qualified
(6) Network technologies and infrastructures
and experienced examiners who have no college education. In
(7) Programming and scripting
fact, much of the expertise in this field is represented by
(8) Computer security
professionals whose practical experience, on-the-job training,
(9) Cryptography
and work credentials qualify them in this discipline. Few
(10) Software tools
institutions offer degrees in the discipline because the field is
(11) Validation and testing
relatively new.As academic programs are developed and made
(12) Cross-discipline awareness
available, it will become preferable for forensic examinations
4.2.5.2 Professional:
to be performed by individuals who have a degree in computer
(1) Critical thinking
forensics (or a related field) supported by experience and
(2) Scientific methodology
training.
(3) Quantitative reasoning and problem solving
4.2.2 The discussion of qualifications presents three alter-
(4) Decision making
native career paths into computer forensics which are depicted
(5) Laboratory practices
in Fig. 1:
(6) Laboratory safety
4.2.2.1 One is for law enforcement personnel who seek to
(7) Attention to detail
move into computer forensics after they become sworn offi-
(8) Interpersonal skills
cers,
(9) Public speaking
4.2.2.2 Another is for persons with relevant technical and
(10) Oral and written communication
critical thinking skills that are equivalent to a bachelor’s
(11) Time management
degree, and
(12) Task prioritization
4.2.2.3 A third is for persons who have earned the formal
(13) Application of digital forensic procedures
degree.
(14) Preservation of evidence
4.2.3 A description of careers in computer forensics is
(15) Interpretation of examination results
provided in Appendix X1.
(16) Investigative process
4.2.4 Personal Characteristics—Computer forensics, like
(17) Legal process
other forensic disciplines, requires personal honesty, integrity,
4.2.5.3 Copies of diplomas and formal academic transcripts
and scientific objectivity. Those seeking careers in this field
are generally required as proof of academic qualification.
should be aware that background checks similar to those
Awards,publications,internships,andstudentactivitiesmaybe
required for law enforcement officers are likely to be a
used to differentiate applicants. Claims in this regard are
condition of employment. The following may be conducted or
subject to verification through the background investigation
reviewed or both before an employment offer is made and may
process.
be ongoing conditions of employment (this list is not all-
4.2.6 Credentials—A digital forensic practitioner should
inclusive):
demonstrate continued professional development that is docu-
(1) Past work performance
mented by credentials. A credential is a formal recognition of
(2) Drug tests
a professional’s KSA. Indicators of professional standing
(3) History of drug use
include academic credentials, professional credentials, training
(4) Driving record
credentials,andcompetencytests.Credentialscanfacilitatethe
(5) Criminal history
qualification of a witness as an expert.
(6) Citizenship
4.3 Implementation: Keys to a Career in Computer Foren-
(7) Credit history
(8) History of hacking sics:
(9) Personal associations
4.3.1 Preemployment Preparation—Competitive candidates
(10) Psychological screening
can demonstrate the interest and aptitude or KSAs that estab-
(11) Medical or physical examination
lish their readiness for a digital forensic position. These KSAs
(12) Polygraph examination
may include areas important to all potential forensic science
4.2.5 Academic Qualifications—Practition
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.