Principles of Digital Forensics Testing
The basis of digital forensics is being able to repeat processes and obtain quality evidence. If the results are not accurate, then it is difficult to trust the laboratory and company. Digital forensic test results need to be repeatable and reproducible to pass as electronic evidence, according to the National Institute of Standards and Technology (NIST).
What is Repeatable and Reproducible Evidence?
Repeatable evidence means there are always the same results when the same process is used with the same test items, operator, and equipment inside the same laboratory. Reproducible evidence means the same results are produced with the same methods on the same items but in a different facility with different operators and equipment.
How Does the Daubert Standard Connect to Forensic Validation?
The Daubert Standard is a legal guide that can be used for software and tool validations. In the ruling of Daubert v. Merrell Dow Pharmaceuticals Inc., there are five questions that influence the reliability of a scientific method:
- Has the method undergone any empirical testing?
- Have peers reviewed the method?
- Are there standards to control the method’s operation?
- Does this method have a potential error rate?
- Has the scientific community generally accepted this method?
This ruling was not directed toward the digital forensics field and validation, but it is useful as a starting point. The ruling also recognized that scientific principles should be flexible and should be the product of reliable methods and principles, which means that although a method may be lacking peer reviews or have acceptance from the community doesn’t mean it’s not valid.