The context
Development of standards for forensic science is important to enhance the reliability, transparency and confidence in forensic evidence. Standards harmonise work practices to facilitate forensic collaboration of different countries, as well as enable their facilities, in response to cross border investigations. Standards also facilitate the exchange of forensic results, information and practices, including the sharing of databases, to ensure forensic services are fit for purpose. Standardisation of the processes of collection, analysis, interpretation and reporting of forensic evidence is critical to the validity of evidence. This is especially relevant for the area of mobile forensics, given the variety and rapid evolution of mobile devices, as well as the amount type and constantly growing complexity of data that can be obtained from them and used as evidence in the court. Consistent and generally accepted standards for mobile forensics within the forensic community may benefit all users of the criminal justice system including members of the public as well as legal and forensic practitioners. A CEN Workshop Agreement (CWA) was proposed and elaborated at the European Committee for Standardization CEN in an open, transparent, inclusive multi-stakeholder-process addressing the project needs and that can be implemented by end users (LEAs) into their chain of custody.
Conformance to relevant standards for law enforcement and forensic agencies ensures that methodologies they apply are robust, verifiable and validated, and that training across jurisdictions or countries is consistent. This strongly impacts the quality of evidence and their acceptance by the courts
Karl Grun, Austrian Standards International
The challenges
Several European and international standardisation bodies work on the standardisation in the area of digital forensics, including ISO and IEC, NIST, ETSI and ASTM. The standards, developed by these organisations do not explicitly address the topic of mobile forensics in digital investigations. This standard is aimed to complement existing standards from these organisations. Currently, they are only partly relevant for the FORMOBILE Project and do not provide a holistic approach to the processes of mobile forensics
How standardisation activities help face the challenges
The primary purpose of the CWA 17865 is to provide recommendations for a complete forensic investigation chain targeting mobile devices that covers good practices for the mobile phone forensic chain, tools for the acquisition, recovery, analysis and visualisation of data, as well as the necessary training required to effectively use the new tools and successfully follow the good practices. These broad topics are covered in the following clauses addressing the three areas of critical importance: Personnel, Tools and Processes. This CWA seeks to document good practice guidance for the correct and necessary processes, competencies and methods required to ensure the admissibility of the evidence. It provides a set of guidelines that fit within the wider context of digital forensic investigations for law enforcement in general at the level of specificity, necessary to keep these guidelines meaningful, whilst simultaneously avoiding such detail that make them quickly obsolete. The guidance in this document is designed to specifically address the specialism of mobile forensics. It is intended to be complementary to existing related standards within the digital forensics sphere.
The Benefits
Applying CWA 17865 leads to enhanced confidence in the evidence using digital forensic methods; robust, verified and validated results of mobile forensics presented in court; improved quality of the evaluation results obtained by means of mobile forensics; harmonized methods of mobile forensics between institutions; better international cooperation in fighting cross-border crime.
The CWA offers a collection of building blocks covering different aspects of mobile forensics allowing for adjustments based on national laws and regulations as well as internal rules and codes of conduct. It also allows LEAs from different countries to accommodate their available technical solutions, at the same time offering a standardised collection of procedures and requirements.
Future plans
CWA 17865 was made publicly available from the CEN Website