SWGDE

Menu
Subscribe
Subscribe

published documents

SWGDE Proficiency Test Guidelines

15-f-002

View Pdf

Disclaimer:

As a condition to the use of this document and the information contained therein, the SWGDE requests notification by e-mail before or contemporaneous to the introduction of this document, or any portion thereof, as a marked exhibit offered for or moved into evidence in any judicial, administrative, legislative or adjudicatory hearing or other proceeding (including discovery proceedings) in the United States or any Foreign country. Such notification shall include: 1) The formal name of the proceeding, including docket number or similar identifier; 2) the name and location of the body conducting the hearing or proceeding; 3) subsequent to the use of this document in a formal proceeding please notify SWGDE as to its use and outcome; 4) the name, mailing address (if available) and contact information of the party offering or moving the document into evidence. Notifications should be sent to secretary@swgde.org.

It is the reader’s responsibility to ensure they have the most current version of this document. It is recommended that previous versions be archived.

Redistribution Policy:

SWGDE grants permission for redistribution and use of all publicly posted documents created by SWGDE, provided that the following conditions are met:

  1. Redistribution of documents or parts of documents must retain the SWGDE cover page containing the disclaimer.
  2. Neither the name of SWGDE nor the names of contributors may be used to endorse or promote products derived from its documents.
  3. Any reference or quote from a SWGDE document must include the version number (or create date) of the document and mention if the document is in a draft status.

Requests for Modification:

SWGDE encourages stakeholder participation in the preparation of documents. Suggestions for modifications are welcome and must be forwarded to the Secretary in writing at secretary@swgde.org. The following information is required as a part of the response:

  1. Submitter’s name
  2. Affiliation (agency/organization)
  3. Address
  4. Telephone number and email address
  5. Document title and version number
  6. Change from (note document section number)
  7. Change to (provide suggested text where appropriate; comments not including suggested text will not be considered)
  8. Basis for change

Intellectual Property:

Unauthorized use of the SWGDE logo or documents without written permission from SWGDE is a violation of our intellectual property rights.

Individuals may not misstate and/or over represent duties and responsibilities of SWGDE work. This includes claiming oneself as a contributing member without actively participating in SWGDE meetings; claiming oneself as an officer of SWGDE without serving as such; claiming sole authorship of a document; use the SWGDE logo on any material and/or curriculum vitae.

Any mention of specific products within SWGDE documents is for informational purposes only; it does not imply a recommendation or endorsement by SWGDE.

Table of Contents

List of Tables

Table 1. Proficiency Test Processes

1. Purpose

The purpose of this document is to provide guidance for testing core competencies for a Digital and Multimedia Evidence (DME) proficiency test program.

2. Scope

The proficiency test program, which is a component of a Quality Assurance program, should verify that the technical procedures are valid and that the quality of each examiner’s work is being maintained.

3. Examination Areas

  • Photography
  • Computer Forensics
  • Mobile Devices
  • Forensic Audio
  • Video Analysis
  • Image Analysis

4. Test Preparation and Design

Proficiency tests may be internal or external, open or blind. Tests shall be procedure specific, process based, and representative of items and technology routinely examined. The test design, test preparation, and expected results shall be documented by an individual or organization identified by the tested organization as technically knowledgeable in the examination area. A second individual or organization identified by the tested organization as technically knowledgeable in the examination area shall confirm the suitability for testing, the completeness of the test, and expected results. The test should be representative of routine DME casework, and the body of knowledge on which the test is based should be clearly defined. Examiners and technical support personnel need only demonstrate proficiency in those processes that are representative of their routine activities. Test participants need not demonstrate proficiency in all of the processes listed below.

The proficiency test should be representative of your typical work and may include, but not limited to, one or more of the processes listed in Table 1. Proficiency Test Processes.

Table 1. Proficiency Test Processes

Photo- graphy Computer Forensics Mobile Devices Forensic Audio Video Analysis Image Analysis
Media/Evidence Handling
X
X
X
X
X
X
Write Protection
X
X
X
(Removable Media)
X
X
X
Transmission Blocking
X
Media Characterization
X
X
X
X
X
X
Acquisition: Physical /Logical Copy
X
X
Media Preparation
X
X
Duplicate/Copy
X
X
X
X
Reconstruction/Recovery
X
X
X
Restoration
X
Image Data Recovery
X
Directory Listing
X
Playback Optimization
X
X
X
Image Content Analysis
X
Extraction/File Carving
X
X
Deleted File Recovery
X
Identification and/or recovery of hidden information
X
X
Identification and/or recovery of encrypted data
X
X
Metadata
X
X
X
Data Extraction
X
X
X
Data Analysis
X
X
X
Signal Analysis
X
Search by Criteria
X
X
Enhancement
X
X
X
X
Internet Activity
X
X
Authentication
X
X
X
Password Recovery
X
X
Standard Conversion
X
X
X
Data Verification
X
X
X
X
X
X
Format Conversion
X
X
X
X
Timeline Sequence
X
X
Photogrammetry
X
X
Demonstrative Comparison
X
X
Photographic Comparison
X
JTAG
X
Chip-off
X
Report of Findings
X
X
X
X
X
X
DVR Data Retrieval
X
X

5. Test Approval

Documentation of test design, test preparation, and expected results will be provided to an individual identified by the organization (not the tested individual) for approval.

6. Testing Process

Proficiency tests will be distributed and conducted according to the organization-approved protocols in effect at the time of the proficiency test.

7. Review of Test Results

The results and supporting documentation will be evaluated by qualified personnel (not the tested individual) identified by the organization. Additionally, results and the evaluation will be provided to management and reviewed with the individual tested. Consequences of pass or failure should be clearly understood by the test taker.

8. Documentation

The proficiency test results and supporting documentation will be retained in accordance with the organization’s documentation retention policy.

9. Corrective Action

Inconsistencies in the proficiency test results are indicative of a problem with the test, the methods or processes used by the individual being tested, the organization’s Quality System, or the individual being tested. These are resolved in accordance with the organization’s policy, which should include the following: the testing process, Quality System, the tested individual, ambiguities within the test and procedures for challenging the test.

SWGDE Proficiency Test Guidelines

Revision Issue Date Section History
1.0
06/04/2015
All
Initial draft created and voted for release as a Draft for Public Comment. This is an update to the document, SWGDE/SWGIT Proficiency Test Program Guidelines, which was originally created and released in collaboration with the Scientific Working Group on Imaging Technology (SWGIT).
1.0
06/20/2015
All
Formatting and technical edit performed for release as a Draft for Public Comment.
1.0
09/17/2015
9
Minor stylistic changes in response to received public comments. SWGDE voted to release as an Approved Document.
1.0
09/29/2015
All
Formatting and technical edit performed for release as an Approved Document.
Version: 1.0 (September 29, 2015)
View Pdf