Forensic Technological Standards
Forensic technological analysis standards address the intersection between forensic investigation and electronic records. Dealing with both the analysis of recovered evidence as well as the electronic storage of forensic information, forensic technology standards seek to preserve information in its original form, for reliable retrieval, whether it is immediate, at a later point in the investigation, or during other investigations. A focus is the applicability of electronic records as legal evidence and the specific guidelines that are enacted towards that goal.
ISO 26430-5:2009
Digital cinema (D-cinema) operations - Part 5: Security log event class and constraints
ISO 26430-5:2009 specifies a Security Event Class and namespace for Security Log Records. It also constrains individual Log Records and sequences of such records (Log Reports) as they are used for security event logging purposes in D-cinema applications. The items covered contain descriptions of events logged by the security system, which are intended to provide forensic information regarding security critical events. ISO 26430-5:2009 does not specify the means of communication or the format of messaging between security devices in a system, nor does it define the format for storage of Log Events within the protected storage of a security device. The Security Log Records and Security Log Record Sequences (Log Reports) described herein are intended for the reporting of Security Events previously recorded by the security system to consumers of that information which are external to the security system.
ISO/TR 12654:1997
Electronic imaging -- Recommendations for the management of electronic recording systems for the recording of documents that may be required as evidence, on WORM optical disk
This Technical Report makes recommendations to be followed in establishing procedures for the capture and storage of electronic images of documents that will ensure the preservation and integrity of the information recorded on the documents. This Technical Report applies to optical storage systems that use only media of a non-reversible Write-Once-Read-Many (WORM) type including compact disk (CD-ROM) to store electronic images of documents. It does not apply to systems that allow an image to be erased or altered after capture.
ISO/TR 18492:2005
Long-term preservation of electronic document-based information
ISO/TR 18492:2005 provides practical methodological guidance for the long-term preservation and retrieval of authentic electronic document-based information, when the retention period exceeds the expected life of the technology (hardware and software) used to create and maintain the information. It takes into account the role of technology-neutral information technology standards in supporting long-term access. This guidance also acknowledges that ensuring the long-term preservation and retrieval of authentic electronic document-based information should involve IT specialists, document managers, records managers and archivists. ISO/TR 18492:2005 does not cover processes for the creation, capture and classification of authentic electronic document-based information. This Technical Report applies to all forms of information generated by information systems and saved as evidence of business transactions and activities.
AIIM TR31/1-1992
Performance Guideline for the Legal Acceptance of Records Produced by Information Technology Systems - Part 1: Performance Guideline for Admissibility of Records Produced by Information Technology Systems as Evidence
Admissibility into evidence of records produced by information technology systems employing media such as microfilm, magnetic tape or magnetic disk (and, by implication optical disk)
ASTM E2678-09(2014)
Standard Guide for Education and Training in Computer Forensics
1.1 This guide will improve and advance computer forensics through the development of model curricula consistent with other forensic science programs. 1.2 Section 4 describes the alternative paths by which students may arrive at and move through their professional training. Sections 5 through 7 cover formal educational programs in order of increasing length: a two- year associate degree, a four-year baccalaureate degree, and graduate degrees. Section 8 provides a framework for academic certificate programs offered by educational institutions. Section 9 outlines model criteria and implementation approaches for training and continuing education opportunities provided by professional organizations, vendors, and academic institutions. 1.3 Some professional organizations recognize computer forensics, forensic audio, video, and image analysis as subdisciplines of computer forensics. However, the curricula and specific educational training requirements of subdisciplines other than computer forensics are beyond the scope of this guide. 1.4 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety and health practices and determine the applicability of regulatory limitations prior to use.
ASTM E2825-21
Standard Guide for Forensic Digital Image Processing
1.1 This guide provides digital image processing guidelines to ensure the production of quality forensic imagery for use as evidence in a court of law. 1.2 This guide briefly describes advantages, disadvantages, and potential limitations of each major process. 1.3 This standard cannot replace knowledge, skills, or abilities acquired through education, training, and experience, and is to be used in conjunction with professional judgment by individuals with such discipline-specific knowledge, skills, and abilities. 1.4 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use. 1.5 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.
ASTM E2763-10
Standard Practice for Computer Forensics
1.1 This practice describes techniques and procedures for computer forensics within the context of a criminal investigation. 1.1.1 This practice can be applicable to civil litigation. 1.2 This practice describes seizing possible evidence, proper evidence handling, digital imaging, forensic analysis/examination, evidence-handling documentation, and reporting. 1.3 This practice is not all inclusive and does not contain information relative to specific operating systems or forensic tools. 1.4 The values stated in SI units are to be regarded as standard. No other units of measurement are included in this standard. 1.5 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety and health practices and determine the applicability of regulatory limitations prior to use.
ASTM E2765-11
Standard Practice for Use of Image Capture and Storage Technology in Forensic Document Examination
1.1 This practice provides procedures to be used by forensic document examiners (Guide E444 ) using image capture and storage technology. 1.2 These procedures are applicable whether the use of the image capture technology involves an item(s) associated with a matter under investigation (questioned or known items), or is for reference. 1.3 These procedures include evaluation of the sufficiency of the available imaging capture and storage technologies. 1.4 Procedures are also outlined for image archiving. 1.5 The particular methods employed in a given case depend upon the nature of the item, or the question at hand, or both. 1.6 This practice might not cover all aspects of the use of image capture and storage technology involving unusual or uncommon items. 1.7 This practice cannot replace the requisite knowledge, skills, or abilities acquired through appropriate education, training (Guide E2388 ), and experience and should be used in conjunction with sound professional judgment. 1.8 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety and health practices and determine the applicability of regulatory limitations prior to use.
