Digital and Multimedia Evidence (Digital Forensics) as a Forensic Science Discipline

Unauthorized use of the SWGDE logo or documents without written permission from SWGDE is a violation of our intellectual property rights.

Individuals may not misstate and/or over represent duties and responsibilities of SWGDE work. This includes claiming oneself as a contributing member without actively participating in SWGDE meetings; claiming oneself as an officer of SWGDE without serving as such; claiming sole authorship of a document; use the SWGDE logo on any material and/or curriculum vitae.

Any mention of specific products within SWGDE documents is for informational purposes only; it does not imply a recommendation or endorsement by SWGDE.

The purpose of this paper is to provide an abstract to assist the reader in understanding that digital forensics is a forensic science and to address confusion about the dual nature of the application of digital forensics techniques as both a forensic science and as an investigatory tool.

Digital forensics as a science is the process used to acquire, preserve, analyze, and report on electronically stored information using scientific methods that are demonstrably reliable, verifiable, and repeatable, such that they may be used in judicial and other formal proceedings. As with other forensic science disciplines, the key attributes of digital forensics applied throughout the entire examination process, from collection through analysis and reporting, are:

• Use of a quality management system containing standard operating procedures and an effective quality assurance program.
• Proficient analysts with appropriate training, expertise, and experience.
• Use of validated tools, processes, and methodologies.
• Objectivity – the forensic analyst must be insulated from work-related undue pressures that could compromise the quality of work.

However, when the techniques commonly associated with digital forensics science are applied as an investigative tool, the focus is on the identification and recovery of information. This approach encourages research and innovation in finding relevant information that could be contained in any number of types of digital media and applications (e.g., computers, cell phones, social media websites, vehicle infotainment systems, home gaming systems, and other dynamic sources of information).

Information can easily flow from digital investigations into digital forensics, but it must be subjected to the rigorous process demanded by the scientific method and rules of evidence. By contrast, the output of digital forensics can easily be used as direct input in digital investigations.