The National Institute of Standards and Technology (NIST) has finalized the report Digital Investigation Techniques: A NIST Scientific Foundation Review.
The report reviews the scientific foundations of forensic methods for analyzing computers, mobile phones and other electronic devices.
A draft report was first published in May and was open for public comments through July. The report was updated based on the comments received and to improve clarity, flow and accessibility.
In the report, the authors point out some limitations of digital investigations that practitioners should be aware of:
- As with any crime scene, not all evidence may be discovered.
- When recovering deleted files, the results may include extraneous material.
- Examiners need to understand the meaning and significance of digital artifacts retrieved as they can change over different versions of operating systems or applications.
The report discusses many areas that need further research and improved processes, including better methods for sharing forensic knowledge among experts, more efficient and consistent approaches to testing forensic tools, and better sharing of forensic reference data.
More details about the report, including a link to download the final version, can be found at https://www.nist.gov/spo/forensic-science-program/digital-investigation-techniques-nist-scientific-foundation-review.
The Center for Statistics and Applications in Forensic Evidence (CSAFE), a NIST Center of Excellence, conducts research addressing the need for forensic tools and methods for digital evidence. Learn more about this research at forensicstats.org/digital-evidence.
