The National Institute of Standards and Technology (NIST) finalized a report in Nov. 2022, first published in draft form in May, that reviews the scientific foundations of forensic methods for analyzing computers, mobile phones and other electronic devices. The full report is available here.
Attorneys may find the report helpful for several reasons. First, the report provides a good overview of the type of information that is not typically available to a user that may be available when an electronic device is forensically examined, such as storing and accessing time, location data on photos, extra copies of data, deleted data, and data about system activities. The report also describes how a digital examiner may stay up-to-date on important developments in a constantly-developing field and some reliable sources for that information. If an examiner fails to keep their information current, it can lead to incomplete analysis or misunderstanding the meaning of results.
The report describes several challenges to recovering deleted or hidden data. Ability to uncover and accurately evaluate the relevance of recovered information may vary depending on the skill of the examiner. The report also describes limitations of tools used to search stored information. Limitations on the searching tool may render some tools unable to find certain information that other tools may be able to find.
The report also helps attorneys understand possible sources of error throughout each step in the digital investigation process, from collection and protection of the data to acquisition to recovery to extraction and analysis. A description of each step and precautions that should be taken is provided. It is important for attorneys to understand that different examiners may find and interpret some data differently due to differences in their training and tools that they employ.
NIST hosted a 3-hour webinar to discuss the draft report and its findings on June 1, 2022. To watch a recording of the webinar click here.
While this report can improve an attorney’s understanding of the methods and results of digital forensic examinations, it is important to seek assistance from a trained and qualified digital examiner to ensure the reliability of results. NC public defenders and IDS Contract attorneys can seek expert assistance with digital evidence through IDS instead of applying to the court for funding by using the Expert Services Project. Additional information about available experts is available here.