In this chapter, we introduce the concepts of digital forensics and experiential learning, and describe how we implement experiential learning in an undergraduate level digital forensic course and a graduate level digital forensic course. The students were given the option of working on either a digital forensic research topic or the Digital Forensic Research Workshop (DFRWS) IoT Forensic Challenge (2018–2019). We also report on the artifacts generated by the students working on both types of final projects.

Experiential Learning in Digital Forensics

The article presents the main provisions of the sub-theory of standardization in the forensic expert activity, its place in the theoretical foundations of forensic expertology, and its relationship with other sub-theories of this science. The author defines the concepts of the subject, the object of the standardization sub-theory in forensic activity, highlights its specifics. The article emphasizes the favorable impact on the development of domestic standardization in forensic activities of foreign experience in the implementation of theoretical developments on standardization, including the formation of a hierarchy of its standards. It is shown that for the development of the sub-theory of standardization in forensic science, it is advisable to use the results of the introduction of standardization mechanisms in the practice of accredited forensic laboratories under the international standard GOST ISO/IEC 17025-2019 “General requirements for the competence of testing and calibration laboratories”, taking into account the theoretical foundations of forensic science.

/pdf/chastnaia-teoriia-standartizatsii-sudebno-ekspertnoi-1ofo1wmikv.pdf

Частная теория стандартизации судебно-экспертной деятельности в общей теории судебной экспертологии

The history of digital forensics and digital evidence is fascinating. For this discussion of the history of digital forensics and digital evidence, we have identified six time periods: (1) Foundation (pre-1980, 1980–1990), (2) Pre-automated Tools & Grassroot efforts (1991–2000), (3) Automated Tools/Acquisition (2001–2010), (4) Analysis & Examination (2011–2015), (5) Meaning & Context (2016–2019), (6) Autonomous Tools (2020-Present). These periods or eras were selected based on the clustering of common operational, legal, and scientific needs and demands. While we use the six eras as a framework for our discussion, these are conceptual and not meant to indicate actual hard demarcation points. 

A Brief History of Digital Forensics and Digital Evidence

This paper examines current best practices for Digital Forensic (DF) tool and method validation in the context of file system interpretation for digital evidence. In order to meet the legal and scientific requirements in criminal procedures file system (FS) reverse engineering (RE) is a necessity. Currently, there is no standard procedure for reliability testing of FS RE. Ideal validation requirements exist, but they are on high-level and practical implementation is missing. In this paper we propose a formal reliability validation procedure for file system reverse engineering, documenting the forensic process, including the tools used, ensuring reliability and reproducibility of the method and the results. The procedure is based on legal and scientific criteria and tested against file system reverse engineering methods. It is applicable to all types of reverse engineering methods in digital forensics.

Reliability validation for file system interpretation

Recently, digital forensics has become increasingly important as it is used by investigation agencies, corporate, and private sector. To supplement the limitations of evidence capacity and be recognized in court, it is essential to establish an environment that ensures the integrity of the entire process ranging from collecting and analyzing to submitting digital evidence to court. In this study, common elements were extracted by comparing and analyzing ISO/IEC 17025, 27001 standards and Interpol and Council of Europe (CoE) guidelines to derive the necessary components for building a digital forensic laboratory. Subsequently, based on 21 digital forensic experts in the field, Delphi survey and verifications were conducted in three rounds. As a result, 40 components from seven areas were derived. The research results are based on the establishment, operation, management, and authentication of a digital forensics laboratory suitable for the domestic environment, with added credibility through collection of the opinions of 21 experts in the field of digital forensics in Korea. This study can be referred to in establishing digital forensic laboratories in national, public, and private digital forensic organizations as well as for employing as competency measurement criteria in courts to evaluate the reliability of the analysis results.

Study on the standard components of digital forensics laboratory

As a result of the many developments in information technology, digital evidence plays an increasingly important role in criminal and civil litigation. Because digital evidence is necessary for litigation, the judicial system must be assured of its accuracy, reliability, and verifiability, which can be assured by accreditation. This paper focuses on a comparison of the evolution of the accreditation of digital forensics internationally and domestically, discusses the existing problems that such accreditation encounters, and proposes the corresponding solutions. Moreover, this paper discusses the future of digital forensic laboratory accreditation and its implementation.

Junlei Hou

Papers

Review of the accreditation of digital forensics in China