Metrology

I haven't produced breakout web-links to the other forum discussions as this post is only raising a point about Metrology and standardisation in digital forensics.

A recent forum question posted by a PhD student sought ideas for a research area. I suggested the following:

You may wish to consider the process of:

(a) examination of mobile/feature/smart phones, embedded devices etc with respect to
(b) evidential examination aligned to iso17025 et al with specific attention interest and engagement to
(c) Metrology - tools used, processes in place and procedures followed
(d) to determine possible impact on evidential results and outcomes.

There is little published study in this area for digital forensics.

The above suggestion, along with suggestions made by others, produced a second forum thread specifically asking about standardisation in digital forensics testing and referred to my comments in the other forum thread. So I made further observations:

The reason why I mentioned Metrology is to actually see whether it is possible to have a minimum standard. In other words, start small and work in areas where commonality in agreement is high amongst those working in digital forensics.

Even before even writing test scripts or anything else start with e.g. the humble physical leads/cables and terminating plugs. They interface with the test tool and the target device. What forensics requirement should there be for these cables/leads/plugs e.g. VGA, DVI, HDMI, Ethernet etc etc. How many people keep a traceable record of what is being used to acquire evidence in the test lab.

iso9001 has been mentioned and this standard provides a useful guide on record keeping. In most cases user take for granted that the cable/lead/plug is ok and just swap it out if it is deemed not working? Simple questions:

1) Is there a cable/lead tester on the market?
2) What results can be obtained?
3) How to determine output results?
4) Compare manufacturing guidelines for MTTF and MTBF?
5) Can the results scrutinised be improved?
6) Can a minimum standard be achieved.

Mundane and tedious testing is never welcomed, but long before digital forensics raised its head these tests were going on. My own earlier experiences were in telecomms manufacturing. We worked with factory type approval guidelines BABT340 and iso9001. Record keeping and testing of tools was fundamental and mandatory to retain quality. Devices were subjected to standards such as bs6301, bs6305, bs6317, bs6789 etc. I still believe that BABT340 and other standards and guidelines for the manufacturing and supply of telecomms and datacomms products for placing on the marketplace are far more aligned to digital forensics and provide industry-specific stepping stones guidance towards minimum standards because all manufacturers were being channelled through the same process.

Just because some of the examples given by the above standards have been replaced with EU or other standards, doesn't mean to say we cannot learn from those industry-specific experience and adopt a similar system.

From what I see going on and hear from others in digital forensics labs cables/leads/plugs can be a source of problems in the acquisition process yet no common ground has been established for their use. There are ISO framework standards adopted for digital forensic labs, but those have been adopted after the fact of produced evidence. But what are the framework standards or common ground documentation directed towards the tools actually being used prior to acquisition and generation of evidence?

ISO 17025 Toolkit

ISO 17025 Toolkit

Members at the Institute for Digital Forensics (IDF) Group at LinkedIn (http://www.linkedin.com/)  we are discussing the creation of an ISO 17025 Toolkit and assistance that might be offered by other QA standards.

You will need to be an approved but free to join participant of the Institute's IDF Group to gain access to the materials.

Mobile Phone is not a 'Closed Container' Part 2

Mobile Phone is not a 'Closed Container' Part 2

I mentioned in the thread " Mobile Phone is not a 'Closed Container' " that there was more to this disucssion:

http://trewmte.blogspot.com/2010/02/mobile-phone-is-not-closed-container.html

When any digital exhibit produces evidence it is normally presented in a computer document format. The Courts looks at the defendant's behaviour in relation to the data shown in the record.

The categories said to underpin S129 Criminal Justuce Act 2003 are set out in Archibold 2010:

Computers

i) The first is where the computer has been used simply as a calculator to process information.

ii) The second category is information which the computer has been programmed to record.

iii) The third category is information recorded and processed by the computer which has been entered by a person, whether directly or indirectly. It is only information from a computer in this third category which is hearsay.

It is Category II (Cat 2) which it is being said that a mobile phone is a dumb terminal which when plugged in is instructed simply to print out, yet examination of the case law used to reference Cat2 does not support the actions of what happens when examinations are conducted on mobile phones.

Category III (Cat 3) is relevant as it covers the multitude of actions that occur from the time the mobile phone is first seized to the time, in the chain of custody, the mobile phone examiner completes his/her examination. Funnily enough it is the mobile phone examiner who is unfairly prejudiced here because it most cases any actions conducted on the mobile phone prior to reaching the moible phone examiner sets him/her up for a dished up fait accompli. That is because phones do not have a specific application creates an audit trail to record all activity of when, for instance, deletion takes place or the person causing that to happen.

Other instances:

- At the point of seizure - entering *#06# (technically that is asterisk* octothorp# 0 6 octothorp#). Then mistakenly pressing the go key with added or deleted entries to the phone memory call history.

- Using faraday bags for sitched on at seizure where the world and his wife can punch away on the keypad of the handset with no traceability and auditability of what has gone on. The exmainer simply cannot be sure where the data comes from.

- the pressing of speed dial keys the place entries in call history.

- opening unread text messages.

With the above examples in mind, what does the Statute set out:

129. Representations other than by a person

(1) Where a representation of any fact -

(a) is made otherwise than by a person, but

(b) depends for its accuracy on information supplied (directly or indirectly) by a person,

the representation is not admissible in criminal proceedings as evidence of the fact unless it is proved that the information was accurate.

(2) Subsection (1) does not affect the operation of the presumption that a mechanical device has been properly set or calibrated.

Mobile telephones are not simple mechnical devices and are not calibrated, after leaving the factory originating their maunfacture, and are not calibrated prior to securing data from them for evidence. When some much goes unchecked with the evidence and the chain of custody can prove quite difficult to establish, how can behaviour in relation to the data be established with proper and appropriate procedual paths in place? The current system is unnecessarily and unwarrantedly crude in its operation demonstrates the lack of necessary skillsets.

I should imagine those in quality assurance (QA) promoting the merits of ISO9000, ISO17020 and ISO17020 are hampered to a greater degree (and most likely apoplectic at this stage) finding out where the difficulties exist. Whilst these standards are excellent (and I do have respect for them) for identifying each stage-point that needs to be reached so that assessment can be conducted to confirm conformity, they have no application to generating the criteria to build each stage-point given the issues associated with Cat 3 S129 CJA2003, above.

There is a way forward though.