E30.12 - Digital and Multimedia Evidence

SIGNIFICANCE AND USE
4.1 The design and configuration of an audio laboratory, as well as the maintenance of equipment, are factors that must be considered to ensure an optimal environment to produce the best results. This guide is intended to provide general guidance for laboratory setup and maintenance.  
4.2 This document is not meant to be an all-inclusive guide on how to set up a laboratory; nor does it contain information pertaining to specific commercial products as it relates to computer hardware, forensic, and non-forensic software applications.  
4.3 When dealing with equipment and technology outside your area of expertise, consult with an appropriate specialist.
SCOPE
1.1 This guide sets forth recommendations for the creation of a forensic audio laboratory space as well as the configuration, verification, and maintenance of the equipment contained within the lab.  
1.2 In designing and configuring an audio laboratory, it is important to consider the acoustical environment/room of the laboratory, as well as climate control. Other than having a viable location for the laboratory, computer hardware and software applications are the most important components of a laboratory.  
1.3 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.4 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
5.1 The protocols that exist for photographing a decedent’s face at autopsy for identification purposes (for example, NAME Forensic Autopsy Performance Standards) do not always result in the capture of facial images that can be used for automated FR searches or manual facial comparisons. It is not always feasible to collect fingerprints from decedents (for example, in disaster situations or when a decedent is in a state of advanced decomposition), and radiograph (medical or dental) comparison requires at least a presumptive identification of remains so appropriate comparative antemortem radiographs can be obtained to confirm the identification. If the decedent’s DNA or appropriate family reference DNA profiles are not already stored within a DNA repository (for example, the FBI’s CODIS), a DNA association will also require the presumptive identification of a decedent to ensure that appropriate samples are collected for comparison/association.  
5.2 It is advisable to follow the guidelines presented in this guide even when not all facial components are present as even incomplete facial images can assist automated FR and manual facial comparison processes, especially through more accurate recording of minute facial details.  
5.3 For the purpose of facial image capture, there are various perimortem or postmortem conditions or both that can degrade the usability of any facial images captured:  
5.3.1 Presence of trauma (for example, entry/exit wounds, lacerations, bruising, missing components, etc.),  
5.3.2 Obscuring matter (for example, blood, fluids, dirt, debris, hair, clothing accessories, and so forth), and  
5.3.3 Decomposition and other postmortem changes (for example, bloating, mummification, skeletonization, evidence of insect or scavenger activity, etc.).  
5.4 Before any attempt is made to clean or alter the decedent for facial image capture, nationally accepted standards or agency protocols or both should be followed so the alterations do not affect ...
SCOPE
1.1 The purpose of this document is to provide guidelines for capturing postmortem facial images of human remains in controlled (for example, morgue) and semi-controlled (for example, field) settings to facilitate automated facial recognition (FR) searches or manual facial comparisons that could contribute to forensic investigations.  
1.2 The values stated in SI units are to be regarded as standard. The values given in parentheses are mathematical conversions to inch-pound units that are provided for information only and are not considered standard.  
1.3 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.4 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
4.1 The key factors that determine image quality for highly controlled facial images (for example: passports, police mugshots, drive motor vehicle, etc.) are well understood with respect to their use in automated FR systems and are a critical factor which directly affects the searching accuracy of the FR system.  
4.2 Image quality also plays a major role in determining the extent to which a trained facial examiner is able to reach a conclusion as to whether two images containing faces are likely to be of the same person or not. This applies to either reviewing a FR system candidate result set or 1:1 image comparisons.  
4.3 This guide provides guidance for the capture of facial images under controlled, semi-controlled, and uncontrolled scenarios for constraints which can be categorized into the following types of requirements:  
4.3.1 Scene, refers to the content, subject and background in the image,  
4.3.2 Photographic, refers to lighting, focus and other constraints required for image capture, and  
4.3.3 Digital, refers to the conversion of the captured image into a digital record.
SCOPE
1.1 This guide is intended for use by practitioners who are choosing, setting up, and operating photographic equipment designed to capture facial images for use with an automated Facial Recognition System or used for manual comparisons by a trained facial examiner. This guide provides an overview of how to achieve the specifications defined in Annex E of ANSI/NIST-ITL-1-2011, Update 2015, for capturing facial images.  
1.2 Annex E of ANSI/NIST-ITL-1-2011 defines a well-controlled capture environment and subject whereas this document will give guidance where tight controls in the capture environment and subject control cannot be achieved.  
1.3 This guide addresses equipment considerations for two-dimensional (2D) conventional images. It does not address video, scanners, or three-dimensional (3D) capture.  
1.4 The values stated in SI units are to be regarded as standard. The values given in parentheses are mathematical conversions to non-SI units that are provided for information only and are not considered standard.  
1.5 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.6 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
5.1 Processed images are used for many purposes by the forensic science community. They can yield information not readily apparent in the original image, which can assist an expert in drawing a conclusion that might not otherwise be reached.  
5.2 This guide addresses image processing and related legal considerations in the following three categories:  
5.2.1 Image enhancement,  
5.2.2 Image restoration, and  
5.2.3 Image compression.
SCOPE
1.1 This guide provides digital image processing guidelines to ensure the production of quality forensic imagery for use as evidence in a court of law.  
1.2 This guide briefly describes advantages, disadvantages, and potential limitations of each major process.  
1.3 This standard cannot replace knowledge, skills, or abilities acquired through education, training, and experience, and is to be used in conjunction with professional judgment by individuals with such discipline-specific knowledge, skills, and abilities.  
1.4 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.5 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
5.1 The procedure described in this document is in accordance with current SWGFAST guidelines (6), as well as National Institute of Standards and Technology (NIST) standard (7), which specify 1000 pixels per inch (ppi) at 1:1 as the minimum scanning resolution for latent print evidence. This standard appears primarily to be historical and directed towards scanners, rather than cameras, though recent studies suggest that it is suitable for capturing Level 3 detail (8).  
5.2 While the 1000 ppi resolution standard permits the capture of level three detail in latent prints, it does not mean that any image recorded at a lower resolution would necessarily be of no value for comparison purposes. Such an image could have captured level two details sufficiently for comparison. However, there are some latent print impressions that are so degraded or contain such limited quantity of information that at least 1000 ppi resolution is required to conduct an accurate examination. Some automated fingerprint identification systems require 1000 ppi for submission purposes. The relationship between machine (optical) resolution and achievable resolution (sometimes called resolving power) can vary greatly by manufacturer (8).
SCOPE
1.1 This practice provides recommendations on the resolving power that enables recording of Level 3 details of latent print evidence that are suitable for comparison purposes using a digital camera, a flatbed scanner, or other image capture device. These recommendations take into consideration the minimum resolution requirements for utilizing the photographs for comparison.  
1.2 This practice describes procedures that can be used to verify the resolving power of such imaging systems and recommends equipment to be used.  
1.3 Certain commercial equipment, instruments, or materials are used in this document as representative examples to more clearly explain the procedures. Such use does not imply a recommendation or endorsement.  
1.4 This standard is intended for use by competent forensic science practitioners with the requisite formal education, discipline-specific training (see Practice E2917), and demonstrated proficiency to perform forensic casework.  
1.5 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.6 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
4.1 As a skimming device is not typically deemed contraband in of itself, it is the responsibility of the examiner to determine if the device contains unauthorized account information. The purpose of this practice is to describe best practices for seizing, acquiring, and analyzing the data contained within magnetic card readers.  
4.2 Limitations—Skimmers present unique examination challenges due to:  
4.2.1 Rapid changes in technology;  
4.2.2 Difficulty of device disassembly;  
4.2.3 Use of alternate/repurposed components;  
4.2.4 Use of encryption or examination countermeasures, or both;  
4.2.5 Multiple data encoding/modulation formats;  
4.2.6 Prevention of chip identification by obfuscation of the device;  
4.2.7 Availability of training and documentation;  
4.2.8 Lack of chip information/documentation;  
4.2.9 Lack of adapters available for chip reading;  
4.2.10 Expense of available equipment used in chip removal and reading;  
4.2.11 Lack of software’s ability to support reading chip data; and  
4.2.12 Lack of commercial software available to analyze encrypted data extracted from skimmers.
SCOPE
1.1 Magnetic card readers, when used for illegal purposes, are commonly referred to as skimmers. This practice provides information on seizing, acquiring, and analyzing skimming devices capable of acquiring and storing personally identifiable information (PII) in an unauthorized manner.  
1.2 This standard cannot replace knowledge, skills, or abilities acquired through education, training, and experience and is to be used in conjunction with professional judgment by individuals with such discipline-specific knowledge, skills, and abilities.  
1.3 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.4 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
3.1 This terminology includes general as well as discipline-specific definitions as they apply across the spectrum of image analysis, computer forensics, video analysis, forensic audio, and facial identification.
SCOPE
1.1 This is a compilation of terms and corresponding definitions used in the examination of digital and multimedia evidence to include the areas of computer forensics, image analysis, video analysis, forensic audio, and facial identification.  
1.2 Legal or scientific terms that generally are understood or defined adequately in other readily available sources may not be included.  
1.3 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
4.1 Morphological analysis used for facial comparison should utilize consistent terminology and methodology. This guide provides a standard set of facial components, characteristics, and descriptors to be used as a framework in conjunction with a systematic method of analysis for facial image comparison.  
4.2 The order of the facial components in this set is presented from the top of the face to the bottom, not in order of importance or priority.  
4.3 Within this guide, the term “face” generally refers to the face, head, and neck inclusively unless specified otherwise.  
4.4 There are several instances in this guide in which the term “distance” or “approximate distance” is used. When this term is used in this guide, it does not mean to imply that the precise value of this dimension shall be determined, but rather the relative size of this dimension compared to the overall width or height of the face, if not otherwise specified. In this guide, it is recommended that photoanthropometry not be used at all because of its limitations.
SCOPE
1.1 This guide defines a set of facial components, characteristics, and descriptors to be considered during a morphological facial comparison (see FISWG Best Practices for Facial Image Comparison Feature List for Morphological Analysis).  
1.2 This set of facial components, characteristics, and descriptors describes the facial features that may be visible and comparable between images.  
1.3 This guide defines a standard set of facial components, characteristics, and descriptors that should be used for facial comparison.  
1.4 This guide does not define the comparison process itself, just the feature set to be used during such comparisons.  
1.5 This guide does not define a classification system to constrain how those descriptors shall be articulated as applied to samples.  
1.6 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.7 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
3.1 Digital and multimedia evidence forensics is a complex field that is heavily reliant on algorithms that are embedded in automated tools and used to process evidence. Weaknesses or errors in these algorithms, tools, and processes can potentially lead to incorrect findings. Indeed, errors have occurred in a variety of contexts, demonstrating the need for more scientific rigor in digital and multimedia evidence forensics. This guide proposes a disciplined approach to mitigating potential errors in evidence processing to reduce the risk of inaccuracies, oversights, or misinterpretations in digital and multimedia evidence forensics. This approach provides a scientific basis for confidence in digital and multimedia evidence forensic results.  
3.2 Error rates are used across the sciences to characterize the likelihood that a given result is correct. The goal is to explain to the reader (or receiver of the result) the confidence the provider of the result has that it is correct. Many forensic disciplines use error rates as a part of how they communicate their results. Similarly, digital and multimedia evidence forensics needs to communicate how and why there is confidence in the results. Because of intrinsic difference between the biological and chemical sciences and computer science, it is necessary to go beyond error rates. One difference between chemistry and computer science is that digital technology is constantly changing and individuals put their computers to unique uses, making it infeasible to develop a representative sample to use for error rate calculations. Furthermore, a digital and multimedia evidence forensic method may work well in one environment but fail completely in a different environment.  
3.3 This guide provides a disciplined and structured approach for addressing and explaining potential errors and error rates associated with the use of digital and multimedia evidence forensic tools/processes in any given environment. This approach to establi...
SCOPE
1.1 This guide provides a process for recognizing and describing both errors and limitations associated with tools, techniques, and methods used to support digital and multimedia evidence forensics. This is accomplished by explaining how the concepts of errors and error rates should be addressed in digital and multimedia evidence forensics. It is important for practitioners and stakeholders to understand that digital and multimedia evidence forensic techniques and tools have known limitations, but those limitations have differences from errors and error rates in other forensic disciplines. This guide proposes that confidence in digital and multimedia evidence forensic results is best achieved by using an error mitigation analysis approach that focuses on recognizing potential sources of error and then applying techniques used to mitigate them, including trained and competent personnel using tested and validated methods and practices. Sources of error not directly related to tool usage are beyond the scope of this guide.  
1.2 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
5.1 Processed images are used for many purposes by the forensic science community. They can yield information not readily apparent in the original image, which can assist an expert in drawing a conclusion that might not otherwise be reached.  
5.2 This guide addresses image processing and related legal considerations in the following three categories:  
5.2.1 Image enhancement,  
5.2.2 Image restoration, and  
5.2.3 Image compression.
SCOPE
1.1 This guide provides digital image processing guidelines to ensure the production of quality forensic imagery for use as evidence in a court of law.  
1.2 This guide briefly describes advantages, disadvantages, and potential limitations of each major process.  
1.3 This standard cannot replace knowledge, skills, or abilities acquired through education, training, and experience, and is to be used in conjunction with professional judgment by individuals with such discipline-specific knowledge, skills, and abilities.  
1.4 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.5 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
3.1 This terminology includes general as well as discipline-specific definitions as they apply across the spectrum of image analysis, computer forensics, video analysis, forensic audio, and facial identification.
SCOPE
1.1 This is a compilation of terms and corresponding definitions used in the examination of digital and multimedia evidence to include the areas of computer forensics, image analysis, video analysis, forensic audio, and facial identification.  
1.2 Legal or scientific terms that generally are understood or defined adequately in other readily available sources may not be included.  
1.3 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
3.1 This terminology includes general as well as discipline-specific definitions as they apply across the spectrum of image analysis, computer forensics, video analysis, forensic audio, and facial identification.
SCOPE
1.1 This is a compilation of terms and corresponding definitions used in the examination of digital and multimedia evidence to include the areas of computer forensics, image analysis, video analysis, forensic audio, and facial identification.  
1.2 Legal or scientific terms that generally are understood or defined adequately in other readily available sources may not be included.  
1.3 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
4.1 The design and configuration of an audio laboratory, as well as the maintenance of equipment, are factors that must be considered to ensure an optimal environment to produce the best results. This guide is intended to provide general guidance for laboratory setup and maintenance.  
4.2 This document is not meant to be an all-inclusive guide on how to set up a laboratory; nor does it contain information pertaining to specific commercial products as it relates to computer hardware, forensic, and non-forensic software applications.  
4.3 When dealing with equipment and technology outside your area of expertise, consult with an appropriate specialist.
SCOPE
1.1 This guide sets forth recommendations for the creation of a forensic audio laboratory space as well as the configuration, verification, and maintenance of the equipment contained within the lab.  
1.2 In designing and configuring an audio laboratory, it is important to consider the acoustical environment/room of the laboratory, as well as climate control. Other than having a viable location for the laboratory, computer hardware and software applications are the most important components of a laboratory.  
1.3 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.4 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
4.1 Processed images are used for many purposes by the forensic science community. They can yield information not readily apparent in the original image, which can assist an expert in drawing a conclusion that might not otherwise be reached.  
4.2 This guide addresses image processing and related legal considerations in the following three categories:  
4.2.1 Image enhancement,  
4.2.2 Image restoration, and  
4.2.3 Image compression.
SCOPE
1.1 This guide provides digital image processing guidelines to ensure the production of quality forensic imagery for use as evidence in a court of law.  
1.2 This guide briefly describes advantages, disadvantages, and potential limitations of each major process.  
1.3 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
5.1 The protocols that exist for photographing a decedent’s face at autopsy for identification purposes (for example, NAME Forensic Autopsy Performance Standards) do not always result in the capture of facial images that can be used for automated FR searches or manual facial comparisons. It is not always feasible to collect fingerprints from decedents (for example, in disaster situations or when a decedent is in a state of advanced decomposition), and radiograph (medical or dental) comparison requires at least a presumptive identification of remains so appropriate comparative antemortem radiographs can be obtained to confirm the identification. If the decedent’s DNA or appropriate family reference DNA profiles are not already stored within a DNA repository (for example, the FBI’s CODIS), a DNA association will also require the presumptive identification of a decedent to ensure that appropriate samples are collected for comparison/association.  
5.2 It is advisable to follow the guidelines presented in this guide even when not all facial components are present as even incomplete facial images can assist automated FR and manual facial comparison processes, especially through more accurate recording of minute facial details.  
5.3 For the purpose of facial image capture, there are various perimortem or postmortem conditions or both that can degrade the usability of any facial images captured:  
5.3.1 Presence of trauma (for example, entry/exit wounds, lacerations, bruising, missing components, etc.),  
5.3.2 Obscuring matter (for example, blood, fluids, dirt, debris, hair, clothing accessories, and so forth), and  
5.3.3 Decomposition and other postmortem changes (for example, bloating, mummification, skeletonization, evidence of insect or scavenger activity, etc.).  
5.4 Before any attempt is made to clean or alter the decedent for facial image capture, nationally accepted standards or agency protocols or both should be followed so the alterations do not affect ...
SCOPE
1.1 The purpose of this document is to provide guidelines for capturing postmortem facial images of human remains in controlled (for example, morgue) and semi-controlled (for example, field) settings to facilitate automated facial recognition (FR) searches or manual facial comparisons that could contribute to forensic investigations.  
1.2 The values stated in SI units are to be regarded as standard. The values given in parentheses are mathematical conversions to inch-pound units that are provided for information only and are not considered standard.  
1.3 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.4 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
4.1 The key factors that determine image quality for highly controlled facial images (for example: passports, police mugshots, drive motor vehicle, etc.) are well understood with respect to their use in automated FR systems and are a critical factor which directly affects the searching accuracy of the FR system.  
4.2 Image quality also plays a major role in determining the extent to which a trained facial examiner is able to reach a conclusion as to whether two images containing faces are likely to be of the same person or not. This applies to either reviewing a FR system candidate result set or 1:1 image comparisons.  
4.3 This guide provides guidance for the capture of facial images under controlled, semi-controlled, and uncontrolled scenarios for constraints which can be categorized into the following types of requirements:  
4.3.1 Scene, refers to the content, subject and background in the image,  
4.3.2 Photographic, refers to lighting, focus and other constraints required for image capture, and  
4.3.3 Digital, refers to the conversion of the captured image into a digital record.
SCOPE
1.1 This guide is intended for use by practitioners who are choosing, setting up, and operating photographic equipment designed to capture facial images for use with an automated Facial Recognition System or used for manual comparisons by a trained facial examiner. This guide provides an overview of how to achieve the specifications defined in Annex E of ANSI/NIST-ITL-1-2011, Update 2015, for capturing facial images.  
1.2 Annex E of ANSI/NIST-ITL-1-2011 defines a well-controlled capture environment and subject whereas this document will give guidance where tight controls in the capture environment and subject control cannot be achieved.  
1.3 This guide addresses equipment considerations for two-dimensional (2D) conventional images. It does not address video, scanners, or three-dimensional (3D) capture.  
1.4 The values stated in SI units are to be regarded as standard. The values given in parentheses are mathematical conversions to non-SI units that are provided for information only and are not considered standard.  
1.5 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.6 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
4.1 As a skimming device is not typically deemed contraband in of itself, it is the responsibility of the examiner to determine if the device contains unauthorized account information. The purpose of this practice is to describe best practices for seizing, acquiring, and analyzing the data contained within magnetic card readers.  
4.2 Limitations—Skimmers present unique examination challenges due to:  
4.2.1 Rapid changes in technology,  
4.2.2 Difficulty of device disassembly,  
4.2.3 Lack of standards in use of the technology,  
4.2.4 Use of alternate/repurposed components,  
4.2.5 Use of encryption,  
4.2.6 Multiple data encoding/modulation formats,  
4.2.7 Prevention of chip identification by obfuscation of the device,  
4.2.8 Availability of training and documentation,  
4.2.9 Lack of chip information/documentation,  
4.2.10 Lack of adapters available for chip reading,  
4.2.11 Lack of software’s ability to support reading chip data, and  
4.2.12 Lack of commercial software available to analyze encrypted data extracted from skimmers.
SCOPE
1.1 Magnetic card readers, when used for illegal purposes, are commonly referred to as skimmers. This practice provides information on seizing, acquiring, and analyzing skimming devices capable of acquiring and storing personally identifiable information (PII) in an unauthorized manner.  
1.2 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety and health practices and determine the applicability of regulatory limitations prior to use.

SIGNIFICANCE AND USE
3.1 Digital forensics is a complex field that is heavily reliant on algorithms that are embedded in automated tools and used to process evidence. Weaknesses or errors in these algorithms, tools, and processes can potentially lead to incorrect findings. Indeed, errors have occurred in a variety of contexts, demonstrating the need for more scientific rigor in digital forensics. This guide proposes a disciplined approach to mitigating potential errors in evidence processing to reduce the risk of inaccuracies, oversights, or misinterpretations in digital forensics. This approach provides a scientific basis for confidence in digital forensic results.  
3.2 Error rates are used across the sciences to explain the amount of uncertainty or the limitation of a given result. The goal is to explain to the reader (or receiver of the result) the confidence the provider of the result has that it is correct. Many forensic disciplines use error rates as a part of how they communicate their results. Similarly, digital forensics needs to communicate how and why there is confidence in the results. Because of intrinsic difference between the biological and chemical sciences and computer science, it is necessary to go beyond error rates. One difference between chemistry and computer science is that digital technology is constantly changing and individuals put their computers to unique uses, making it infeasible to develop a representative sample to use for error rate calculations. Furthermore, a digital forensic method may work well in one environment but fail completely in a different environment.  
3.3 This document provides a disciplined and structured approach for addressing and explaining potential errors and error rates associated with the use of digital forensic tools/processes in any given environment. This approach to establishing confidence in digital forensic results addresses Daubert considerations.
SCOPE
1.1 This guide provides a process for recognizing and describing both errors and limitations associated with tools used to support digital forensics. This is accomplished by explaining how the concepts of errors and error rates should be addressed in digital forensics. It is important for practitioners and stakeholders to understand that digital forensic techniques and tools have known limitations, but those limitations have differences from errors and error rates in other forensic disciplines. This guide proposes that confidence in digital forensic results is best achieved by using an error mitigation analysis approach that focuses on recognizing potential sources of error and then applying techniques used to mitigating them, including trained and competent personnel using tested and validated methods and practices.

SIGNIFICANCE AND USE
3.1 Digital forensics is a complex field that is heavily reliant on algorithms that are embedded in automated tools and used to process evidence. Weaknesses or errors in these algorithms, tools, and processes can potentially lead to incorrect findings. Indeed, errors have occurred in a variety of contexts, demonstrating the need for more scientific rigor in digital forensics. This guide proposes a disciplined approach to mitigating potential errors in evidence processing to reduce the risk of inaccuracies, oversights, or misinterpretations in digital forensics. This approach provides a scientific basis for confidence in digital forensic results.  
3.2 Error rates are used across the sciences to explain the amount of uncertainty or the limitation of a given result. The goal is to explain to the reader (or receiver of the result) the confidence the provider of the result has that it is correct. Many forensic disciplines use error rates as a part of how they communicate their results. Similarly, digital forensics needs to communicate how and why there is confidence in the results. Because of intrinsic difference between the biological and chemical sciences and computer science, it is necessary to go beyond error rates. One difference between chemistry and computer science is that digital technology is constantly changing and individuals put their computers to unique uses, making it infeasible to develop a representative sample to use for error rate calculations. Furthermore, a digital forensic method may work well in one environment but fail completely in a different environment.  
3.3 This document provides a disciplined and structured approach for addressing and explaining potential errors and error rates associated with the use of digital forensic tools/processes in any given environment. This approach to establishing confidence in digital forensic results addresses Daubert considerations.
SCOPE
1.1 This guide provides a process for recognizing and describing both errors and limitations associated with tools used to support digital forensics. This is accomplished by explaining how the concepts of errors and error rates should be addressed in digital forensics. It is important for practitioners and stakeholders to understand that digital forensic techniques and tools have known limitations, but those limitations have differences from errors and error rates in other forensic disciplines. This guide proposes that confidence in digital forensic results is best achieved by using an error mitigation analysis approach that focuses on recognizing potential sources of error and then applying techniques used to mitigating them, including trained and competent personnel using tested and validated methods and practices.

SIGNIFICANCE AND USE
3.1 This terminology includes general as well as discipline-specific definitions as they apply across the spectrum of image analysis, computer forensics, video analysis, forensic audio, and facial identification.
SCOPE
1.1 This is a compilation of terms and corresponding definitions used in the examination of digital and multimedia evidence to include the areas of computer forensics, image analysis, video analysis, forensic audio, and facial identification.  
1.2 Legal or scientific terms that generally are understood or defined adequately in other readily available sources may not be included.

SIGNIFICANCE AND USE
Processed images are used for many purposes by the forensic science community. They can yield information not readily apparent in the original image, which can assist an expert in drawing a conclusion that might not otherwise be reached.  
5.2 This guide addresses image processing and related legal considerations in the following three categories:  
Image enhancement,
Image restoration, and  
Image compression.
SCOPE
1.1 This guide provides digital image processing guidelines to ensure the production of quality forensic imagery for use as evidence in a court of law.  
1.2 This guide briefly describes advantages, disadvantages, and potential limitations of each major process.

SIGNIFICANCE AND USE
With the proliferation of computers and other electronic devices, it is difficult to imagine a crime that could not potentially involve digital evidence. Because of the paucity of degree programs in computer forensics, practitioners have historically relied on practical training through law enforcement or vendor-specific programs or both.
In this guide, curricula for different levels of the educational system are outlined. It is intended to provide guidance to:
Individuals interested in pursuing academic programs and professional opportunities in computer forensics,
Academic institutions interested in developing computer forensics programs, and
Employers seeking information about the educational background of graduates of computer forensics programs and evaluating continuing education opportunities for current employees.
SCOPE
1.1 This guide will improve and advance computer forensics through the development of model curricula consistent with other forensic science programs.
1.2 Section 4 describes the alternative paths by which students may arrive at and move through their professional training. Sections 5 through 7 cover formal educational programs in order of increasing length: a two- year associate degree, a four-year baccalaureate degree, and graduate degrees. Section 8 provides a framework for academic certificate programs offered by educational institutions. Section 9 outlines model criteria and implementation approaches for training and continuing education opportunities provided by professional organizations, vendors, and academic institutions.
1.3 Some professional organizations recognize computer forensics, forensic audio, video, and image analysis as subdisciplines of computer forensics. However, the curricula and specific educational training requirements of subdisciplines other than computer forensics are beyond the scope of this guide.  
1.4 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety and health practices and determine the applicability of regulatory limitations prior to use.

SIGNIFICANCE AND USE
3.1 This guide provides an outline of the knowledge, skills, and abilities all practitioners of mobile phone forensics should possess. The core competencies provide a basis for training and testing programs. This basis is suitable for certification, competency, and proficiency testing.
SCOPE
1.1 This guide identifies the core competencies necessary for the handling and forensic processing of mobile cellular (cell) telephones (phones). It applies to both first responders and laboratory personnel.  
1.2 Different levels of cell phone analysis are discussed as well as the basic skills required at each of these levels.  
1.3 This guide does not address core competencies for chip-off or MicroRead extraction methods.  
1.4 Refer to the Scientific Working Group on Digital Evidence (SWGDE) Guidelines and Recommendations for Training in Digital and Multimedia Evidence for general training requirements of forensic practitioners.  
1.5 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety and health practices and determine the applicability of regulatory limitations prior to use.
WITHDRAWN RATIONALE
This guide identified the core competencies necessary for the handling and forensic processing of mobile cellular (cell) telephones (phones). It applied to both first responders and laboratory personnel.
Formerly under the jurisdiction of Committee E30 on Forensic Sciences, this guide was withdrawn in January 2024 in accordance with section 10.6.3 of the Regulations Governing ASTM Technical Committees, which requires that standards shall be updated by the end of the eighth year since the last approval date.

SIGNIFICANCE AND USE
3.1 With the proliferation of computers and other electronic devices, it is difficult to imagine a crime that could not potentially involve digital evidence. Because of the paucity of degree programs in computer forensics, practitioners have historically relied on practical training through law enforcement or vendor-specific programs or both.  
3.2 In this guide, curricula for different levels of the educational system are outlined. It is intended to provide guidance to:  
3.2.1 Individuals interested in pursuing academic programs and professional opportunities in computer forensics,  
3.2.2 Academic institutions interested in developing computer forensics programs, and  
3.2.3 Employers seeking information about the educational background of graduates of computer forensics programs and evaluating continuing education opportunities for current employees.
SCOPE
1.1 This guide will improve and advance computer forensics through the development of model curricula consistent with other forensic science programs.  
1.2 Section 4 describes the alternative paths by which students may arrive at and move through their professional training. Sections 5 through 7 cover formal educational programs in order of increasing length: a two- year associate degree, a four-year baccalaureate degree, and graduate degrees. Section 8 provides a framework for academic certificate programs offered by educational institutions. Section 9 outlines model criteria and implementation approaches for training and continuing education opportunities provided by professional organizations, vendors, and academic institutions.  
1.3 Some professional organizations recognize computer forensics, forensic audio, video, and image analysis as subdisciplines of computer forensics. However, the curricula and specific educational training requirements of subdisciplines other than computer forensics are beyond the scope of this guide.  
1.4 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety and health practices and determine the applicability of regulatory limitations prior to use.
WITHDRAWN RATIONALE
This guide will improve and advance computer forensics through the development of model curricula consistent with other forensic science programs.
Formerly under the jurisdiction of Committee E30 on Forensic Sciences, this guide was withdrawn in January 2023 in accordance with section 10.6.3 of the Regulations Governing ASTM Technical Committees, which requires that standards shall be updated by the end of the eighth year since the last approval date.

SIGNIFICANCE AND USE
The purpose of this practice is to describe techniques and procedures for computer forensics in regard to evidence handling, computers, digital imaging, and forensic analysis and examination.
The examiner should be trained in accordance with Guide E2678.
Individuals not trained in proper digital evidence procedures should consult with an appropriate specialist before proceeding.
When dealing with technology outside your area of expertise, consult with an appropriate specialist before proceeding.
SCOPE
1.1 This practice describes techniques and procedures for computer forensics within the context of a criminal investigation.
1.1.1 This practice can be applicable to civil litigation.
1.2 This practice describes seizing possible evidence, proper evidence handling, digital imaging, forensic analysis/examination, evidence-handling documentation, and reporting.
1.3 This practice is not all inclusive and does not contain information relative to specific operating systems or forensic tools.  
1.4 The values stated in SI units are to be regarded as standard. No other units of measurement are included in this standard.
1.5 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety and health practices and determine the applicability of regulatory limitations prior to use.
WITHDRAWN RATIONALE
This practice describes techniques and procedures for computer forensics within the context of a criminal investigation.
Formerly under the jurisdiction of Committee E30 on Forensic Sciences, this practice was withdrawn in January 2019 in accordance with section 10.6.3 of the Regulations Governing ASTM Technical Committees, which requires that standards shall be updated by the end of the eighth year since the last approval date.