ASTM E3016-15

NOTICE: This standard has either been superseded and replaced by a new version or withdrawn.
Contact ASTM International (www.astm.org) for the latest information
Designation:E3016 −15
StandardGuide for
Establishing Confidence in Digital Forensic Results by Error
1
Mitigation Analysis
This standard is issued under the fixed designation E3016; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision.Anumber in parentheses indicates the year of last reapproval.A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope Indeed, errors have occurred in a variety of contexts, demon-
strating the need for more scientific rigor in digital forensics.
1.1 This guide provides a process for recognizing and
This guide proposes a disciplined approach to mitigating
describing both errors and limitations associated with tools
potential errors in evidence processing to reduce the risk of
used to support digital forensics. This is accomplished by
inaccuracies, oversights, or misinterpretations in digital foren-
explaininghowtheconceptsoferrorsanderrorratesshouldbe
sics.Thisapproachprovidesascientificbasisforconfidencein
addressed in digital forensics. It is important for practitioners
digital forensic results.
and stakeholders to understand that digital forensic techniques
and tools have known limitations, but those limitations have
3.2 Error rates are used across the sciences to explain the
differences from errors and error rates in other forensic
amount of uncertainty or the limitation of a given result. The
disciplines. This guide proposes that confidence in digital
goal is to explain to the reader (or receiver of the result) the
forensic results is best achieved by using an error mitigation
confidencetheprovideroftheresulthasthatitiscorrect.Many
analysisapproachthatfocusesonrecognizingpotentialsources
forensic disciplines use error rates as a part of how they
of error and then applying techniques used to mitigating them,
communicate their results. Similarly, digital forensics needs to
including trained and competent personnel using tested and
communicate how and why there is confidence in the results.
validated methods and practices.
Because of intrinsic difference between the biological and
chemical sciences and computer science, it is necessary to go
2. Referenced Documents
beyond error rates. One difference between chemistry and
2
2.1 ISO Standard:
computer science is that digital technology is constantly
ISO/IEC 17025General Requirements for the Competence changing and individuals put their computers to unique uses,
of Testing and Measurement Laboratories
making it infeasible to develop a representative sample to use
3
for error rate calculations. Furthermore, a digital forensic
2.2 SWGDE Standards:
method may work well in one environment but fail completely
SWGDE Model Quality Assurance Manualfor Digital Evi-
dence in a different environment.
SWGDE Standards and ControlsPosition Paper
3.3 This document provides a disciplined and structured
SWGDE/SWGIT Proficiency TestProgram Guidelines
approach for addressing and explaining potential errors and
SWGDE/SWGIT Guidelines & Recommendations for
error rates associated with the use of digital forensic tools/
Training in Digital & Multimedia Evidence
processes in any given environment. This approach to estab-
lishingconfidenceindigitalforensicresultsaddresses Daubert
3. Significance and Use
considerations.
3.1 Digitalforensicsisacomplexfieldthatisheavilyreliant
on algorithms that are embedded in automated tools and used
4. Background
to process evidence. Weaknesses or errors in these algorithms,
4.1 Digital forensic practitioners are confident in the ability
tools, and processes can potentially lead to incorrect findings.
of their methods and tools to produce reliable conclusions;
however, they often struggle to establish their confidence on a
1
This guide is under the jurisdiction of ASTM Committee E30 on Forensic
scientific basis. Some forensic disciplines use an error rate to
Sciences and is the direct responsibility of Subcommittee E30.12 on Digital and
describe the chance of false positives, false negatives, or
Multimedia Evidence.
otherwise inaccurate results when determining whether two
Current edition approved May 1, 2015. Published June 2015. DOI: 10.1520/
E3016-15.
samples actually come from the same source. But in digital
2
Available fromAmerican National Standards Institute (ANSI), 25 W. 43rd St.,
forensics, there are fundamental differences in the nature of
4th Floor, New York, NY 10036, http://www.ansi.org.
3
many processes that can make trying to use statistical error
Available from the Scientific Working Group on Digital Evidence (SWDGE),
https://www.swgde.org. rates inappropriate or misleading.
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959. United States
1

---------------------- Page: 1 -
...