Board Certifications
Certified Digital Media Examiners are investigators who have demonstrated competency
in pre-examination procedures and legal issues, media assessment and analysis, data
recovery, specific analysis of recovered data, documentation and reporting, and
presentation of findings. However, there is no single certifying body and each program
can contain different courses of study. Vendor-neutral (not software based, but theoryand process- based) certification is offered through the Digital Forensics Certification
Board (DFCB), an independent certifying organization for digital evidence examiners,
the National Computer Forensics Academy at the High Tech Crime Institute and some
colleges. Some agencies do not require its examiners to be certified.
The DFCB offers two certifications: 1) digital forensic certified associate (DFCA) and 2)
digital forensics certified practitioner (DFCP). DFCP requires two or more years of
“practical experience” in the last three years while DFCA does not. However, both
require the applicant to have a minimum of five years of digital forensics experience
overall. Also, this certification tests more than one’s knowledge of any particular
software, and assures those certified are knowledgeable in “the collection of digital
forensics, the legal components, the validation of forensic tools, the reporting, etc. We
want to be able to ensure a successful candidate is able to be fully versed in the entire
digital forensics profession.”
Laboratory Accreditation
ASCLD-LAB (American Society of Crime Laboratory Directors-Laboratory
Accreditation Board) approved Digital Evidence in 2003 to be a designated discipline for
which ASCLD accreditation may be obtained. The current accreditation category is now
called 'Digital and Multimedia Evidence' and is offered for any or all of four subdisciplines: Computer Forensics, Forensic Audio, Video Analysis and Image Analysis.
There are basic criteria which digital evidence examiners must meet.
By attaining ASCLD/LAB accreditation, a laboratory demonstrates that its management,
operations, personnel, procedures, equipment, physical plant, security, and health and
safety procedures all meet “established and recognized international standards.”
Accreditation can provide a means to improve quality, assess performance, provide
independent review, meet established standards, and serve to ensure the promotion,
encouragement, and maintenance of the highest standards of forensic practice. Testimony
from an examiner working in an accredited laboratory can assist in meeting the
challenges of Frye or Daubert and assure the court that examination results are accurate,
technically competent, and valid, based upon required quality assurance practices.
External independent review can demonstrate management’s commitment to ensuring
that its Quality Management System and its physical plant meet or exceed documented
standards of practice. (http://www.dfinews.com/articles/2012/02/iso/iec-170252005accreditation-digital-forensics-discipline#.Ut2Gw3n0Ay4)
Currently there are 73 laboratories that are accredited in digital and multimedia evidence.
(http://www.ascld-lab.org/accredited-laboratory-index/)
Digital Evidence Groups and Professional Associations
Scientific Working Group on Digital Evidence (SWGDE)
The Scientific Working Group on Digital Evidence was created in 1998 to explore digital
evidence as a forensic discipline with a primary focus on laboratories. The SWGDE’s
mission is to bring “together organizations actively engaged in the field of digital and
multimedia evidence to foster communication and cooperation as well as ensuring quality
and consistency within the forensic community. The group began by developing
universal principles in the disciplines of audio, visual, and computer forensics. Two
current documents under discussion are practices in imaging and analyzing Macintosh
computers and the effect of Unified Extensible Firmware Interface (UEFI) on media
imaging.
These documents can be found on the following links:
https://www.swgde.org/documents/Released%20For%20Public%20Comment/2013-0914%20SWGDE%20Mac%20OS%20X%20Tech%20Notes%20V1V1
https://www.swgde.org/documents/Released%20For%20Public%20Comment/2013-0914%20SWGDE%20UEFI%20Effect%20on%20Digital%20Imaging%20V1
To become a member, one must be nominated by a fellow member and fill out an
application. Those considered are currently within the field of digital evidence and
making contributions to the field and are fulfilling the mission of the group.
Scientific Working Group on Imaging Technology (SWGIT)
SWGIT is one group that works alongside SWGDE on various projects that involve
aspects of image technology. This group has also aided ASCLD-LAB is establishing
definitions and standards for the accreditation of Digital and Multimedia Evidence.
Documents co-published with SWGDE are the following links:
https://www.swgit.org/pdf/Guidelines%20and%20Recommendations%20for%20Training
%20in%20Digital%20and%20Multimedia%20Evidence?docID=57
https://www.swgit.org/pdf/Proficiency%20Test%20Program%20Guidelines?docID=58
https://www.swgit.org/pdf/Recommended%20Guidelines%20for%20Developing%20Sta
ndard%20Operating%20Procedures?docID=59
https://www.swgit.org/pdf/SWGDE%20and%20SWGIT%20Digital%20and%20Multime
dia%20Evidence%20Glossary?docID=60
To become a regular member, the applicant must be full-time personnel of an
international, state or local law enforcement agency. Those that are educators,
commercial representatives, contractors, and others may join as an associate member.
AAFS
A digital and multimedia examiner may obtain membership in the American Academy of
Forensic Sciences’ Digital and Multimedia section (established 2008) by demonstrating
the examiner has attained a bachelor’s degree, has five years experience in one of the
forensic sciences within the scope of coverage acceptable to the Section, or a master’s
degree and four (4) years of similar experience or a doctorate degree, and three (3) years
of similar experience. Examiners must also demonstrate current involvement in the
forensic discipline. Lastly, digital and multimedia examiners wishing to apply for
membership into the AAFS must supply two letters of recommendation; at least one must
come from a current member.
IAI
The IAI Digital Evidence Subcommittee was formed in 2002 as a new discipline category
in the IAI. The first Digital Evidence Subcommittee meetings and presentations were
held in 2003 at the annual IAI Conference in Ottawa, Canada. Members of the
committee work in all areas of digital forensics including computer forensics, video and
multimedia, digital device forensics (cell phones, pdas, etc.).
Mission: To promote the principles of forensic science for gathering, handling,
processing and storage of digital evidence. To be the center of excellence in the IAI
community for fostering increased awareness of digital evidence issues in the interests of
justice and assistance to the law enforcement community.
Goals:
1) Interact in a positive way with other IAI disciplines to encourage more education and
appreciation for the protection and handling of digital evidence.
2) Encourage presentation of case related digital evidence issues at IAI meetings and
conferences.
3) Provide a forum for the law enforcement forensic community to discuss digital
evidence related issues.
4) Cooperate with other related digital evidence groups; for example, SWGDE (Scientific
Working Group on Digital Evidence) and SWGIT (Scientific Working Group on Imaging
Technology) for the resolution of common issues.