ASTM E2916-19e1

This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the
Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.
´1
Designation: E2916 − 19 An American National Standard
Standard Terminology for
Digital and Multimedia Evidence Examination
This standard is issued under the fixed designation E2916; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
ε NOTE—Format correction was editorially applied to the definition of ‘resolution’ in April 2019.
1. Scope 2.3 ISO Standards:
ISO/IEC 10918-1:1994 Information Technology — Digital
1.1 This is a compilation of terms and corresponding
Compression and Coding of Continuous-Tone Still Im-
definitions used in the examination of digital and multimedia
ages: Requirements and Guidelines
evidence to include the areas of computer forensics, image
analysis, video analysis, forensic audio, and facial identifica-
3. Significance and Use
tion.
3.1 This terminology includes general as well as discipline-
1.2 Legalorscientifictermsthatgenerallyareunderstoodor
specific definitions as they apply across the spectrum of image
defined adequately in other readily available sources may not
analysis, computer forensics, video analysis, forensic audio,
be included.
and facial identification.
1.3 This international standard was developed in accor-
dance with internationally recognized principles on standard-
4. Terminology: Terms and Definitions
ization established in the Decision on Principles for the
4.1 Definitions:
Development of International Standards, Guides and Recom-
achievable resolution, resolving power, n—the measure of
mendations issued by the World Trade Organization Technical
imaging system’s practical limit to distinguish between
Barriers to Trade (TBT) Committee.
separate adjacent elements, typically by imaging a known
2. Referenced Documents
reference standard.
2.1 ANSI/NIST Standards:
acquisition, n—in computer forensics, the process of using an
ANSI/NIST-ITL 1-2011 Data Format for the Interchange of
access interface to read digital data from a digital source and
Fingerprint, Facial, and Other Biometric Information
to create a destination object.
NIST SP 800-86 Guide to Integrating Forensic Techniques
ad hoc image, n—see uncontrolled image.
into Incident Response
NIST SP 800-88 Guidelines for Media Sanitization
allocated space, allocated storage, n—in computer forensics,
2.2 IEEE Standards:
the portions of storage that are assigned or reserved for
IEEE 100-2000 The Authoritative Dictionary of IEEE Stan-
active instructions or for data.
dards Terms, 7th Edition
IEEE 100-2000, (C) 610.10-1994w
anthropometric analysis, n—in facial identification,anex-
plicit measurement of landmarks on a face and a comparison
of these measurements between two samples.
anti-forensics, n—the application of a process to modify,
conceal or destroy information to inhibit or prevent the
effectiveness of forensic science examinations.
This terminology is under the jurisdiction of ASTM Committee E30 on
archive image, n—in computer forensics,a bit stream dupli-
Forensic Sciences and is the direct responsibility of Subcommittee E30.12 on
cate of data placed on media that is suitable for long-term
Digital and Multimedia Evidence.
storage.
Current edition approved March 1, 2019. Published March 2019. Originally
approved in 2013. Last previous edition approved in 2018 as E2916 – 18. DOI:
10.1520/E2916-19E01.
Available from National Institute of Standards and Technology (NIST), 100
Bureau Dr., Stop 1070, Gaithersburg, MD 20899-1070, http://www.nist.gov. Available from International Organization for Standardization (ISO), ISO
Available from Institute of Electrical and Electronics Engineers, Inc. (IEEE), Central Secretariat, BIBC II, Chemin de Blandonnet 8, CP 401, 1214 Vernier,
445 Hoes Ln., Piscataway, NJ 08854, http://www.ieee.org. Geneva, Switzerland, http://www.iso.org.
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959. United States
´1
E2916 − 19
artifact, n—a by-product, artificial feature, or change resulting capture, v—to record data, such as an image, video sequence,
from human activity or a technical process. (Compare audiostream,orbiometricsampletodigitalstorage,oftenby
noise.) means of a sensor.
DISCUSSION—Examples include speckles in a scanned picture,
capture card, frame grabber, n—a piece of computer hard-
“blocking” in compressed images, distortion in over-saturated audio,
ware that accepts an analog or digital signal and outputs the
and the automatic creation of temporary files due to normal usage of a
computer. signal as digital data.
aspect ratio, n—the ratio of the width to the height of a capture device, n—device used in the recording of data.
rectangle, such as an image, a pixel, or an active video
carve, v—in computer forensics, to extract a portion of data for
frame.
the purpose of analysis.
attempt, n—in facial identification, a submission of a single
certification authority, n—(1) in computer forensics, a trusted
set of biometric samples to a biometric system for identifi-
third party entity that issues digital certificates certifying the
cation or verification. (Compare biometric search.)
ownership of a public key by the subject named in the
audio enhancement, n—the processing and filtering of audio
certificate, and trusted by both entities engaged in a digital
recordings to improve the signal quality and intelligibility of transaction; (2) in facial identification, a body that issues
thesignalsofinterest,suchasspeech,byattenuatingnoiseor
biometric documents and certifies that the data stored on the
otherwise increasing the signal-to-noise ratio. documents are genuine.
backlight, n—in facial identification, a light source placed
clarification, n—see enhancement.
behind a subject in a controlled capture that reduces back-
clarify, n—see enhance.
ground shadows.
clean room, clean chamber, positive air flow cabinet, n—to
backlit, adj—a characteristic of a subject or an object that is
the extent possible, a limited particulate environment.
illuminated from behind.
DISCUSSION—For example, requirements would follow ISO 5 or
Class 100 standard for air quality.
batch mode search, n—in facial identification, a mode of
searching records in an automated system in which a group
clear, v—in computer forensics, to overwrite storage space on
of probes are simultaneously or sequentially launched.
a medium with non-sensitive data, which may include
overwriting not only the logical storage location of files, but
batch search mode, n—see batch mode search.
may include all addressable locations. NIST SP 800-88
binning, n—in facial identification,(1) any technique used by
cluster, n—in computer forensics, a group of contiguous
a facial recognition (FR) system to organize or optimize
sectors on storage media, typically the smallest unit of
searching based upon some piece(s) of metadata; (2) the
allocation in a filesystem.
process of parsing (examining) or classifying data to accel-
erate or improve biometric matching.
codec, n—an algorithm to encode and decode digital data,
typically to reduce the amount of data for transmission or
biometric search, n—the submission of a biometric reference
storage.
as a probe against a biometric system for identification
DISCUSSION—Acodec is not a storage format, but may be required to
(one-to-many) or verification (one-to-one). (Compare at-
interpret stored data.
tempt.)
cognitive image analysis, n—in image and video analysis,a
bit stream, n—a continuous stream of bits transmitted over a
process used to extract visual information from an image by
channel with no separators between the character groups.
human evaluation.
IEEE 100-2000, (C) 610.7-1995, 610.10-1994w
color range, n—see gamut.
bit stream duplicate, n—in computer forensics, an exact,
bit-for-bit reproduction of all data objects independent of composite video signal, n—a single analog video signal that
anyphysicalmediauponwhichthatdataisstored.(Compare combines a base-band luminance signal with color informa-
copy.) tion by modulating a subcarrier with chroma signals, typi-
cally using one of the National Television System Commit-
cache, n—in computer forensics, a temporary storage area set
tee (NTSC), Phase Alternating Line (PAL), or Sequential
aside on a processor, in memory, or in a filesystem to keep
Color with Memory (SECAM) systems.
frequently needed data readily available, designed to speed
up processing and improve performance. compression, n—a process to reduce the size of a data file or
stream while attempting to retain the original semantic
candidate list, n—in facial identification, a rank ordered list
meaning of that data.
generated from a facial recognition search.
compression ratio, n—the ratio of the size of the data before
capture, n—(1)theprocessofrecordingdatasuchasanimage,
compression to that of after compression.
video sequence, or audio stream; (2) in facial identification,
the process of collecting a biometric sample from an computer forensics, n—thescientificexamination,analysis,or
individual via a sensor. evaluation of digital evidence in legal matters.
´1
E2916 − 19
controlled image, n—in facial identification, a photographic enhancement, n—in audio, image, and video analysis, the
image captured in accordance with facial identification (FI) processofimprovingtheperceptualrecognitionorqualityof
or facial recognition (FR) standards or guidelines (for a signal of interest.
example, a driver’s license photo).
enroll, v—to capture a biometric sample, extract the relevant
copy, v—toreproduceinformationwithsomelevelofaccuracy.
features, convert them to a template, and use it to form a
DISCUSSION—Depending on the process used, copying might result in
reference for matching.
the loss of data. (Compare bit stream duplicate.)
DISCUSSION—Enrollment most often is performed to populate a
gallery, but it can also refer to the creation of a probe.
data, n—information in analog or digital form that can be
transmitted or processed.
examiner, n—in facial identification, an individual whose role
it is to perform a facial examination.
data file, n—a file consisting of stored data (that is, text,
numbers, graphics, etc.) as compared to a program file of
export, n—see download (1).
commands and instructions for a digital device.
extraction, n—any method of exporting data from a source.
deblur, v—to restore an image by attempting to reverse
degradation caused by blur. face detection, n—in facial identification, the automated
determination of the presence of human faces in digital
deinterlace, v—to separate an interlaced video frame into its
images.
two discrete fields.
face recognition, n—in facial identification,(1) by automated
digital device, n—electronic equipment which can create,
systems,theautomatedsearchingofafacialimageasaprobe
process or store digital data.
in a facial recognition system (one-to-many), typically
resulting in a group (candidate list) of facial images being
digital evidence, n—information of probative value that is
stored or transmitted in binary form. returned to a human operator in ranked order based on
system-evaluated similarity; (2) by humans, the mental
digital image, n—in image analysis,aphotographicimagethat
process by which an observer identifies a person as being
is represented by discrete numerical values organized in a
one they have seen before.
two-dimensional array.
Focal Encyclopedia of Photography
facial comparison, n—in facial identification, a manual pro-
cesstoidentifysimilaritiesordissimilaritiesbetweentwo(or
digital object, n—a collection of logically related information.
more) facial images or facial image(s) and a live subject for
digital source, n—a container of digital data that can be the purpose of determining if they represent the same person
or different person.
acquired by an acquisition tool.
digital video recorder, DVR, n—a stand-alone embedded
facial examination, n—in facial identification, a formal sys-
system or a computer-based system for recording video and,
tematic facial comparison.
optionally, audio data.
facial identification, FI, n—the discipline of image-based
directory,n—in computer forensics,anobjectorstructureused
comparisons of human facial features.
to group files together within a filesystem.
facial mapping, n—the process of landmarking defined an-
directory listing, n—in computer forensics, a list of files and,
thropological points.
optionally, file properties contained within a filesystem.
facial recognition, FR, n—see face recognition.
download, v—(1) in audio, image, and video analysis,to
facial review, n—in facial identification, an adjudication of a
retrieve audio, video, image, or transactional data from a
candidate list.
recording device (for example, DVR system); (2) in com-
puter forensics, to receive data from another digital source.
feature, n—in facial identification and image analysis,an
observable class or individual characteristic.
dynamic range, n—(1) in image analysis, the difference
between the brightest highlight and darkest value that a
field, n—in video analysis, a set of odd or even scan lines
sensor can detect and record in a single image; (2) in audio
comprising one half of an interlaced video frame.
and video analysis, the ratio of the strongest (undistorted)
DISCUSSION—For interlaced video, the scanning pattern is divided
signal to that of the weakest (discernible) signal in a unit or
into two sets of spaced lines (odd and even) that are displayed
systemasexpressedindecibels(dB);(3)awayofstatingthe
sequentially. Each set of lines is called a field, and the interlaced set of
maximum signal-to-noise ratio.
the two sets of lines is a frame.
enhance, v—in audio, image, and video analysis, to improve
file, n—in computer forensics, a collection of information
the perceptual recognition or quality of a signal of interest.
logically grouped into a single object and referenced by an
identifier, such as a filename.
file format, n—in computer forensics, a standard structure by
Focal Encyclopedia of Photography, 3rd edition, Richard D. Zakia and Leslie
Stroebel, Eds., Focal Press, 1996. which data is organized in a file for a specific purpose.
´1
E2916 − 19
file header, n—in computer forensics, the data within a file that gamut, n—the portion of the colorspace that can be repre-
contains identifying information about the file and possibly sented or reproduced by a device or process.
metadata with information about the file contents.
Gaussian blur, n—in image and video analysis, a function
filename, n—in computer forensics, an identifier used to typically used to reduce image noise and detail using a
specific mathematical function known as the “Gaussian
uniquely identify a file object within a directory object in a
filesystem. Kernel” or “bell-curve.”
grayscale image, greyscale image, n—an image encoded with
file slack, n—in computer forensics, the data between the
a single channel or component.
logical end of a file and the end of the last storage unit for
that file.
grayscale transformation, greyscale transformation,
n—operation that modifies a single channel or component of
filesystem, file system, n—in computer forensics, a specified
image data (for example, a single color).
method for naming, storing, organizing, and accessing files
on logical volumes.
hash, hash value, n—a string of numerical values used to
substantiate the integrity of digital evidence or for inclusion/
fixed focal length lens, prime lens, n—a lens with a focal
exclusion comparisons against known value sets or both.
length that is not adjustable.
hashing function, n—an established mathematical calculation
focal length, n—the distance from the optical center of a lens
that generates a numerical value based on input data.
to its point of focus at the sensor or image plane when
focused at infinity.
hidden data sector, n—in computer forensics, a sector in the
current configuration of a drive that cannot be accessed by
forensic video analysis, n—see video analysis.
read and write commands without changing the drive con-
forensic audio, n—the scientific examination, analysis,
figuration.
comparison, or evaluation of audio.
DISCUSSION—Sectors in a host protected area would be hidden data
sectors.
forensic cloning, v—creating a bit stream duplicate of the
histogram, n—a graph of a frequency distribution in which
available data from one physical media to another.
rectangles with bases on the horizontal axis are given widths
forensic image, n—see image.
equal to the class intervals and heights equal to the corre-
sponding frequencies.
forensic wipe, n—in computer forensics,averifiableprocedure
DISCUSSION—In digital images, a histogram is frequently used to
for sanitizing a defined area of digital media by overwriting
document the number of pixels of a given brightness value (for
each byte with a known value.
example, 0-255).
format, n—the structure by which data are organized on a
holistic comparison, n—in facial identification, a process of
device.
comparing faces by looking at the face as a whole and not
DISCUSSION—A format can refer to a physical medium, a type of
the component parts in isolation.
signal, a file format, encoding parameters, or combinations thereof.
hot spot, n—in facial identification, a bright area of light
format, v—to prepare a hard disk or a removable data storage
reflecting on a face that reduces the visibility of features.
device to enable data storage using a specified filesystem or
data structure.
image, v—in computer forensics, to create a bit stream dupli-
cate of the original data.
format conversion, n—in audio, image, and video analysis,
the transfer of audio or video information, or both, from one image, n—(1) in image and video analysis, an imitation or
format to another.
representation of a person or thing drawn, painted, or
photographed; (2) in computer forensics—see bit stream
frame, n—in video analysis, the lines of spatial information of
duplicate.
a video signal.
DISCUSSION—For interlaced video, a frame consists of two fields, one image analysis, n—the application of image science and
of odd lines and one of even lines, displayed in sequence. For
domain expertise to examine and interpret the content of an
progressive scan (non-interlaced) video, the frame is written through
image, the image itself, or both in legal matters.
successive lines that start at the top left of the picture and finish at the
bottom right.
image averaging, n—in image and video analysis, the process
of averaging similar images, such as sequential video
free space, n—see unallocated space.
frames, to reduce noise in stationary scenes.
frontal pose, n—in facial identification, a facial image cap-
image comparison, photographic comparison, n—in image
turedfromdirectlyinfrontofthesubjectwiththefocalplane
analysis, the process of comparing images of questioned
approximately parallel to the plane of the subject’s face.
objects or persons to known objects or persons or images
gallery, n—in facial identification, a FR system’s database, thereof and making an assessment of the correspondence
which typically contains all known-person biometric refer- between features in these images for rendering an opinion
ences (samples or templates, or both). regarding identification or elimination.
´1
E2916 − 19
image content analysis, n—in image analysis, the drawing of levels of conclusion, n—in facial identification, a verbal or
conclusions about an image and targets for content analysis numericscalethatindicatesthelevelofconfidenceregarding
include, but are not limited to, the subjects/objects within an identification or exclusion of a subject.
image; the conditions under which, or the process by which,
lights out, n—in facial identification, an automated conclusion
the image was captured or created; the physical aspects of
based upon threshold scores with no human involvement.
the scene (for example, lighting or composition); or the
provenance of the image.
log file, n—a record of actions, events, and related data.
logical acquisition, logical copy, n—in computer forensics,an
image data recovery, n—in image analysis, the process of
accurate reproduction of information contained within a
retrieving viewable image(s) from a data set.
logical volume (for example, mounted volume, logical drive
image enhancement, n—any process intended to improve the
assignment, and so forth).
visual appearance of an image or specific features within an
DISCUSSION—Logical acquisitions or copies may not reproduce
image. deleted data, or data otherwise not accessible easily by a user.
logical volume, n—in computer
...