|
|
Content Assessment: A Solid Foundation? NIST Publishes Review of Digital Forensics Methods
Information - 95%
Insight - 94%
Relevance - 92%
Objectivity - 93%
Authority - 96%
94%
Excellent
A short percentage-based assessment of the qualitative benefit of the post highlighting the recent NIST draft report on the foundations of digital investigation techniques.
Background Note: Digital devices have become ubiquitous in our lives. Many of the tasks of everyday lives are intertwined with mobile digital devices such as cell phones and tablets, personal computers, and other digital devices. Every interaction with a digital device has the potential to leave a trail of what we did, who we did it with, where we were, and when the event took place. Digital forensics is the application of the scientific method to make sense of the trail left by interaction with a digital device. The new draft report Digital Investigation Techniques: A NIST Scientific Foundation Review explores the scientific foundation of digital forensics and may be beneficial for cybersecurity, information governance, and legal discovery professionals operating in the eDiscovery ecosystem and seeking to better understand digital evidence investigations and examinations.
Announcement and Draft Report*
NIST Publishes Review of Digital Forensic Methods
Report documents the scientific foundations of digital evidence examination and recommends ways to advance the field.
The National Institute of Standards and Technology (NIST) has published Digital Investigation Techniques: A NIST Scientific Foundation Review. This draft report, which will be open for public comment for 60 days, reviews the methods that digital forensic experts use to analyze evidence from computers, mobile phones, and other electronic devices.
The purpose of NIST scientific foundation reviews is to document and evaluate the scientific basis for forensic methods. These reviews fill a need identified in a landmark 2009 study by the National Academy of Sciences, which found that many forensic disciplines lack a solid foundation in scientific research.
To conduct their review, the authors examined peer-reviewed literature, documentation from software developers, test results on forensic tools, standards and best practices documents, and other sources of information. They found that “digital evidence examination rests on a firm foundation based in computer science,” and that “the application of these computer science techniques to digital investigations is sound.”
“Copying data, searching for text strings, finding timestamps on files, reading call logs on a phone. These are basic elements of a digital investigation,” said Barbara Guttman, leader of NIST’s digital forensics research program and an author of the study. “And they all rely on fundamental computer operations that are widely used and well understood.”
The report also discusses several challenges that digital forensic experts face, including the rapid pace of technological change. “Digital evidence techniques don’t work perfectly in all cases,” Guttman said. “If everyone starts using a new app, forensic tools won’t be able to read and understand the contents of that app until they are updated. This requires constant effort.”
To address this challenge, the report recommends better methods for information-sharing among experts and a more structured approach to testing forensic tools that would increase efficiency and reduce duplication of effort across labs.
The report also recommends increased sharing of high-quality forensic reference data that can be used for education, training, and developing and testing new forensic tools.
NIST’s Digital Forensics Research Program, which was launched in 1999, develops methods for testing digital forensics tools and provides access to high-quality reference datasets. NIST also maintains a vast archive of published software, the National Software Reference Library, that is a critical resource for investigating computer crimes.
NIST scientific foundation reviews help laboratories identify appropriate limitations on the use of forensic methods, identify priorities for future research, and suggest steps for moving the field forward. These reviews are conducted as part of NIST’s Forensic Science Program, which works to strengthen forensic practice through research and improved standards. In 2018 Congress directed NIST to conduct these scientific reviews and appropriated funding for them.
Readers can submit comments on the draft report through July 11, 2022. NIST will host a webinar about the draft report on June 1, 2022. Instructions for submitting comments and registration information for the webinar are available on the NIST website.
Read the original announcement.
NIST.IR.8354-Draft
Read the original publication.
Additional Reading
- Embracing Differences? Interplay of Digital Forensics in eDiscovery
- Defining Cyber Discovery? A Definition and Framework
Source: ComplexDiscovery
