Standardization Requirements for Digital Forensic Laboratories: A Document Analysis and Guideline
Alshebel, Abdullah Khaled S
MetadataShow full metadata
In recent years, the rapid growth in technology has played an essential role in transforming the lives of humans. It has changed the way individuals communicate and it can improve their quality of life. The increase of the usage of technological solutions has led to an increase in crimes committed using technology or technologies that are present at a crime scene and have evidence. The justice systems worldwide tend to prosecute criminal actions based on evidence, and today much of the evidence is in digital formats. Digital evidence can be examined and analysed using specialized equipment and software within a digital forensic laboratory. Digital forensic laboratories control the quality and competency of the digital forensic work through the adoption of International Standards for best practice. At present there is no one Standard for Digital Forensic laboratories but rather general laboratory Standards and specialist laboratory Standards, such as medical. Researchers have referred to in the literature, the absence of a specific digital forensics laboratory Standard, and yet after a decade, the absence remains the same. The ISO/IEC 17025, is a general Standard for the competence of testing and calibration in laboratories, and has been adapted to accredit digital forensics laboratories. However, the ISO/IEC 17025 only addresses a restricted set of risks while leaving many matters in relation to digital evidence untreated. Even though there is a paucity of literature examining digital forensic laboratory requirements, the establishment of secure practices for a new digital forensic laboratory requires a strenuous of effort. The exception is Watson & Jones (2019), which clarifies the requirements for best practices. The next step is to establish an International agreement through Standardization. Thus, to fill this gap, this research aimed to draft a Standard proposal and implementation guideline. Design Science (DS) is chosen as the appropriate research methodology, so that a solution can be proposed but then improved by expert feedback. The draft Standard is first constructed from literature, and then improved by expert feedback. A systematic literature review has been used through the adoption of a well-known literature search method called Preferred Reporting Items for Systematic reviews and Meta-Analyses (PRISMA). The result is that electronic libraries have been systematically searched and the selected literature used as the basis for a theoretical solution to the problem of a Digital Forensic Laboratory Standard. The significant results from the research are the writing of a draft Standard and an implementation guideline (see Figures 5.1 and 5.2 for element analysis). The draft Standard, was termed the artefact in the design science methodology. A significant finding during the experts' evaluation of the artefact were the requirements for preparatory handling of evidence, and a requirement to establish a research centre within the digital forensic laboratory. The second concern is to assure the continuous improvement of the digital forensic laboratory technical capability and to keep ahead of changes in both designs and potential technology use. A well-known project management methodology is advised to implement the Standard. For future work, several recommendations are made that will lead to a more comprehensive management of risks around digital evidence.