Not Comfortable Fit for Digital Forensics - ISO17025

Within the digital forensics arena there is discomfort amongst labs, academia, businesses and practitioners that ISO/IEC 17025 'General requirements for the competence of testing and calibration laboratories' is not a comfortable fit for digital forensics. Very few digital forensics laboratories and businesses have been accredited so far. To get an understanding of concerns obtained from a pretty good base-data of opinion from replies to UK ISO 17025 Digital Forensics Survey 4/24/2017 created by Professor Peter Sommer, the results have been published and are available here http://goo.gl/KP0HOn .

Not to second guess the Forensic Science Regulator (FSR) there is , of course, the October 2017 deadline looming and the outcomes of that deadline might impact on the way forward. However, I regularly keep an eye on Lab Accreditation and Best Practice Guides (as you can see from some of the pdf tabs open in the above screen shot) in context with digital forensics in order to note the changing approach to digital forensics. The new breeze appears to suggest digital forensics blowing towards ISO standards e.g.

ISO/IEC 27042: 2015. Information Technology - Security Techniques - Guidelines for the Analysis and Interpretation of Digital Evidence.

ISO/IEC 27037: 2012. Information Technology - Security Techniques - Guidelines for Identification, Collection, Acquisition and Preservation of Digital Evidence.

Currently, but this may change, these standards are not substitutes for accreditation. That does not mean though digital forensics may not branch off and have its own unique accreditation and standards. It may well be the British Standards Institute (BSI) may need to produce an equivalent standard for the UK based upon an example of the old BS5750 approach. BS5750 and ISO9000 do enable the UK Government's requirement to be met for "inclusion" of single-person organisations and SMEs to play apart in the economy and not be excluded from it due to globalism or restraint of trade practices or over-burdensome control measures.

Previously, I drew attention to how in the US, Karin Athanas, Program Manager at the American Association for Laboratory Accreditation (A2LA), produced an article titled "Accreditation for the One-Person Organization - The smallest laboratories can teach us the biggest lessons.". This article defined that smaller business entities could achieve accreditation to ISO/IEC17025: http://trewmte.blogspot.co.uk/2016/10/isoiec-1702517020-one-person.html

The UK ISO 17025 Digital Forensics Survey 4/24/2017 isn't the first time attention has been drawn to ISO/IEC17025 that it should works for all, not the few. If the latter accreditation doesn't work then maybe another route will need to be found.

ISO/IEC 17025/17020 - One-Person Organisation

Having just finished part two of the work study into QA and Laboratory Accreditation MTEB UK SEMINARS 2016 II v03- QA Lab Accreditation.pdf ( http://trewmte.blogspot.co.uk/2016/10/qa-and-laboratory-accreditation.html ) I came across this cracking article by Karin Athanas, Program Manager at the American Association for Laboratory Accreditation (A2LA) titled "Accreditation for the One-Person Organization - The smallest laboratories can teach us the biggest lessons." ( http://forensicfoundations.com/resources/Documents_CLR/2016_10_3_SUMMER.pdf )

Basically Karin's article helps us understand that one, two or three person/s organisation/s should not be put off but can and should apply for ISO/IEC 17020 and 17025 as the requirements are not insurmountable, particularly when it comes to allocation to whom the quality manager's role, audits etc. will be allocated and deemed to be responsible. I also read this to mean that ABs might need to widen their scope to appreciate many roles in a accredited system can be held by one person.

Karin's article is a recommended read.

QA and Laboratory Accreditation

MTEB UK SEMINARS 2016 II v03- QA Lab Accreditation.pdf
Read more - updated link http://tinyurl.com/zr2oqyp

QA and Laboratory Accreditation. Previously, lab criteria applied to mobile phone forensic testing was randomly applied:

- various industry standards
- public and private approach to best practice
- guidelines/training courses
- Some certified ISO9001, some sought UKAS accreditation.

The introduction of a UK Forensic Science Regulator (FSR), there are now mandated ‘Codes of Practice and Conduct’, standards and accreditation applicable to mobile phone forensic evidence:

- ISO/IEC 17025 e.g. requirements for the competence to carry out tests and calibrations...
- ISO/IEC 17020 e.g. scene of crime and in the field activity
- UKAS Accreditation

The FSR’s strategy moves the goalposts away from simply applying industry best practice and random approaches to a common purpose – provision of forensic science across the criminal justice system is "subject to an appropriate regime of scientific quality standards"

That common purpose approach has been developing for approximately 6 years but only really in the last several years ISO/IEC 17025:2005 has  started to make its mark and the first accreditation to requirements of Forensic Science Regulator’s ‘Codes of Practice and Conduct’ was  2014.

- still early days for the public and private sectors
- very small number of organisations accredited for mobile phone forensic evidence
- it could be said we are all pioneers to new endeavours
- common purpose does not dilute ‘speciality’ distinguishing one organisation from another
- FSR deadlines for public sector forensic science overall 2017-2020
- e.g. Law enforcement mobile phone forensic test laboratory accreditation by Oct 2017
- Lead times of 18-months to implement suggests 2017 deadline could be missed
- ‘devil in the detail’ causing much more work than at first thought

There is increased demand for practical solutions and helpful insights that may assist prepare for accreditation.

Metrology - USB part 2

Continuing with the discussion relating to Metrology and Universal Serial Bus (USB) cables.

Metrology - http://trewmte.blogspot.co.uk/2015/05/metrology.html
In the first discussion it raised the observations iso9001 has been mentioned and this standard provides a useful guide on record keeping. In most cases users take for granted that the cable/lead/plug is ok and just swap it out if it is deemed not working? Simple questions:

1) Is there a cable/lead tester on the market?
2) What results can be obtained?
3) How to determine output results?
4) Compare manufacturing guidelines for MTTF and MTBF?
5) Can the results scrutinised be improved?
6) Can a minimum standard be achieved.

Metrology - USB part 1 - http://trewmte.blogspot.co.uk/2015/06/metrology-usb-part-1.html
Later the discussion raised the notion that smartphones, tablets and other devices fitting the description Size-Scaled Digital Technology (SSDT) using USB physical connectivity provides for the simplest of examination DUT illustrations e.g. the combination of three separate entities involved in inter-connection during an examination:

1) DUT (the target device (SSDT) containing suspected evidence
2) The physical medium (USB) to carry the source data to the examination tool
3) The examination tool (ET) used to extract and harvest evidence

And ended with the point that the discussion started out by referring to the physical medium USB to carry the source data from the DUT to the examination tool (ET). The relevance of doing so is that if the examiner eliminates the medium as the cause for failure or corrupted evidence then the logical conundrum that remains, is the DUT at fault, is the ET at fault or are both DUT/ET together faulty?

In order to eliminate the USB cable's involvement in the acquisition process as the source of causing corrupted data or inducing faults into the DUT requires expanding the investigation of what is known about USB tolerances or identified faults.

Mechanical Failures

Types of USB connector left to right (ruler in centimetres): micro-B plug, UC-E6 proprietary (non-USB) plug, mini-B plug, standard-A receptacle (upside down), standard-A plug, standard-B plug

The procedure required to dissect and strip back a USB plug from its cable. In itself, there is nothing special in this task being performed other than for revelation purposes to allow observations of what is happening underneath the main moulded cable covering, due to the fact that the human eye does not possess x-ray vision. This USB cable was chosen as it had visible signs of wear and tear at the USB plug end that connects to the device (DUT) and charging of a DUT was known to be intermittent.

The USB cable was terminated at either end with a mini-B plug and standard-A plug. The photo below shows the mini-B plug end has been dissected and stripped back.

 The standard coloured wiring is expressed as:

Pin 1		VCC (+5 V, red wire)
Pin 2		Data− (white wire)
Pin 3		Data+ (green wire)
Pin 4		Ground (black wire)

It was noticeable from a study of the separate coloured internal wire covers - Green, Red, Black and White ( For a quick reference source refer to https://en.wikipedia.org/wiki/USB. ) - that the Red wire cover was in fact a Pink in colour with deterioration (more brittle, easy to pull off covering) than the other coloured coverings.

Given that the mini-B plug is the end that is connected into the DUT raises concerns as to whether the wear and tear could cause damage to the DUT, too. As the Red(Pink) coloured cover concerns the power V_CC (+5 V, red wire) it is not difficult to speculate the potential for damage or failure and that on the balance of probability (at one of the end of the scale) the quality assurance programme should have identified this as a problem or issue to be addressed, (and at the other end of the scale) that beyond reasonable doubt the quality control processes should have removed this physical medium (USB cable) from the pool of tools/devices that could be used during an examination process.

The sampling rates for conducted Vbus and Vcc etc tests can be deduced from the USB standards. Full USB compliance test equipment maybe expensive for those who are trading as a one-man business. There are some simple test rigs out there which require the use of a digital multimeter and test cables that may offer a lower cost solution worth investigating.

One such rig is USB Tester from Fried Circuits http://friedcircuits.us/docs/usb-tester

Another rig from the same source is USB Tester and Phone Charging http://friedcircuits.us/docs/usb-tester-and-phone-charging/

Inexpensive rigs like these should not be a problem but it is essential to carefully document their use in your QA procedures and their requirement to be calibrated.

There are still numerous matters to discuss that have been identified regarding Metrology and USB, which shall be published shortly. The total sum of these discussion Parts build eventually to an identified set of criteria that examiners may wish to apply for QA purposes to reduce or remove the medium USB as having an adverse impact during data acquisition between a DUT and the ET.

Examination Techniques8: Simple Experiments2

Examination Techniques8: Simple Experiments2

Continuing the discussion to offer suggestions on ways to generate test methodologies in order that down the line it might be possible to create validation and verification processes, practices and procedures for mobile phone examination (device under test (DUT)). 

Assuming that an examiner is satisfied as to when s/he is using the appropriate tool that it will extract and harvest data from the make/model (DUT) under examination, there will still be the prior query what exactly is this tool communicating to the DUT? For instance, considering logical data as opposed to physical data, does the tool intended for use provide an "output log" that contains the communications (commands) sent to the DUT (e.g. APDU or AT+ etc etc) so that the examiner:

- can corroborate what is being instructed to the DUT when that tool is applied to it?
- comprehend are the responses (data) received from the DUT to be expected or are the data incomplete?
- Should the data be incomplete, is that because the commands are incorrect in their instructions which data are to be extracted or is it because the handset has not stored any further data other than that data returned in response to the command sent?

The objective of this simple experiment is to observe the content of any harvested logical data so that when dealing with physical (deleted) data recovery an examiner can start to build a template, from known logical data samplings, in order to apprehend some understanding of any deleted data that has been recovered as to what maybe there and what maybe missing.

Previous discussions relevant to this topic:
Examination Techniques6: Simple Experiments - http://trewmte.blogspot.co.uk/2012/03/examination-techniques6-simple.html

Examination Techniques5: Validation and Verification - http://trewmte.blogspot.co.uk/2012/03/examination-techniques5-validation-and.html

External links:
http://www.forensicfocus.com/Forums/viewtopic/t=8879/

Examination Techniques6: Simple Experiments

Examination Techniques6: Simple Experiments

Leaving validation to one side, when I am teaching mobile phone examination I get delegates on the course to try lower level tests, at first instance.


Try this experiment:

1) Conduct acquisition and harvesting of the handset's SMS text message logical data.

2) Produce a paper printout report of all those text messages (this will be one test guide).

3) Through the handset reading tool you are using display the text messages on the screen of your computer (this will be another test guide)

4) With the test handset switched ON view the text on the screen and take screen shots. The information in the screen shots should be as complete as that which can be viewed on the screen of the handset by the ordinary user (this will be yet another test guide).

The purpose of this experiment is, having cross-referenced all the three test guides, to see if they are, in the first instance, identical in every way? Moreover, can the tests be replicated by an examiner with the same system or another system?

Another simple experiment to consider:

To consider and, through trial and error, discover when would you apply a hash value?

Does your tool currently produce a hash displayed on the screen for each text message or are all of the saved text messages given a hash value?

Specifically, when your computer produces the output of data on to printed paper, is a hash value displayed (somewhere) and, if so, is the hash value the same as seen in the program on the computer screen or is it the hash value for the data that is actually printed on the paper (or would you need another value for that)?

With respect to the handset screen shots, would they need a hash value and would the hash value be created by the screen shot program for the images or the printed out data.

The purpose of this experiment is to identify exactly the relevance of hash values and to what they are being attributed, to what they technically prove (or who they exonerate), apart from having loads of hash values needing to be explained to a Court where the hash values do not exactly corroborate each other, but different things.

Now re-run the experiments with two different handset readers.

Previous discussions about some issues associated with validation and verification:

http://www.trewmte.blogspot.co.uk/2012/03/examination-techniques5-validation-and.html

http://trewmte.blogspot.co.uk/2010/06/evidence-and-admissibility-part-1.html

http://trewmte.blogspot.co.uk/2008/12/nokia-6233-clock.html

http://trewmte.blogspot.co.uk/2008/11/mobile-phones-and-fringe-coverage.html

Examination Techniques5: Validation and Verification

Examination Techniques5: Validation and Verification
The constant and never ending challenge to ensure examination tools meets the requirements when used with or applied to the DUT (device under test) naturally generates constantly evolving polices, practices and procedures. The 'digitally-evolving' and 'technology-fast development' age has brought with it an inability to keep policies, practices and procedures up-to-date. That includes the tools and techniques that maybe used or applied.

Examiners may find it helpful when dealing with Validation and Verification:

- To validate is to assess doing the right things,
- To verify is to evaluate doing things right.

As always, Wikipedia has interesting articles and prompts that can help start researching points:

http://en.wikipedia.org/wiki/Verification_and_validation

However, a word of caution and a useful philosophical approach to remember, born out of having previously had experience and worked in QA, factory assessment/evaluation pre-approval and technology assessment. When considering Validation and Verification they hold the same unlying warning as that attributed to Galileo, who said "the Bible shows the way to go to heaven, not the way the heavens go". Thus agreeing that validation is being performed does not necessarily mean verification will automatically support that claim.