《历史性观点看数字取证》由会员分享，可在线阅读，更多相关《历史性观点看数字取证（9页珍藏版）》请在金锄头文库上搜索。
1、International Journal of Digital EvidenceSpring 2002 Volume 1, Issue 1www.ijde.orgAn Historical Perspective of Digital Evidence: A Forensic Scientists View Carrie Morgan Whitcomb, Director, National Center for Forensic ScienceAuthors CommentsDuring my tenure as director of the Postal Inspection Head
2、quarters Laboratory (1988-1992), a Postal Inspector submitted a computer to examine for the presence of specific evidence he had enumerated in the letter of request. The evidence technician logged in the computer, assigned it a case number, and brought the request to me, inquiring “What should we do
3、 with this?” That was the beginning of an odyssey that I still pursue.The Inspection Service Laboratory had a Questioned Document Section. Since a computer seemed to be an obvious evolution of paper documents, I called the manager of that section, Drew Somerford, and asked him to take the case. He w
4、as reluctant to sign for the evidence. Even though there might have been “documents” on the hard drive, it was outside his expertise. How do you secure and preserve the evidence? How do you collect it without changing it? What are the accepted practices related to computer evidence that would stand
5、the scrutiny of court? What are the examination protocols? It was technology that we did not know how to handle in the crime laboratory.We submitted the computer evidence to the Federal Bureau of Investigation (FBI). The FBI Laboratory had a unit for computer evidence, and they worked the case. The
6、Postal Inspection Service had a team of inspectors who were trained to work computer crime cases, but the laboratory was not equipped to assist them in processing evidence at that time.BackgroundComputer forensic science is largely a response to a demand for service from the law enforcement communit
7、y. As early as 1984, the FBI Laboratory and other law enforcement agencies began developing programs to examine computer evidence. To properly address the growing demands of investigators and prosecutors in a structured and programmatic manner, the FBI established the Computer Analysis and Response
8、Team (CART). Although CART is unique in the FBI, its functions and general organization are duplicated in many other law enforcement agencies in the United States and other countries (Noblett, Pollitt, nothing in the handwritten information should be obliterated or erased. Notes and records should b
9、e authenticated by handwritten signatures, initials, digital signatures, or other marking systems.Standards and Criteria 1.7Any action that has the potential to alter, damage, or destroy any aspect of original evidence must be performed by qualified persons in a forensically sound manner.Discussion.
10、 As outlined in the preceding standards and criteria, evidence has value only if it can be shown to be accurate, reliable, and controlled. A quality forensic program consists of properly trained personnel and appropriate equipment, software, and procedures to collectively ensure these attributes (SW
11、GDE/IOCE, 2000, pp. 3-7).Accreditation of Digital Evidence by ASCLD/LABWhile SWGDE was working on best practices, it was determined that we must also have a deliberate plan for gaining acceptance by the forensic science community. We were on the “frontier” of a new forensic science. Others have blaz
12、ed the trail and all we need to do is follow it. DNA created the SWG process. The American Society of Crime Laboratory Directors/Laboratory Accreditation Board (ASCLD/LAB) has an accreditation process that spells out criteria that must be met by specific disciplines in forensic laboratory operations
13、. SWGDE voted to follow the format of the ASCLD/LAB Accreditation Manual for writing their standards. The major categories are: Principle, Standards and Criteria, Discussion. The manual addresses Laboratory Management and Operation, Personnel Qualifications, and Physical Plant.Membership in The Amer
14、ican Academy of Forensic Sciences (AAFS) for Digital Evidence ExaminersThe AAFS is the most prestigious national organization for forensic scientists. Thus far, digital evidence papers have been presented in various sections. If the digital evidence community is to consider forming their own section
15、, there must be a minimum of fifty academy members that petition the board to form such a section. As the Executive Secretary of SWGDE, I gave a presentation to the AAFS Board of Directors at the 2002 meeting concerning the activities of SWGDE and the status of forensic digital evidence. AAFS sugges
16、ted that all potential members in the digital evidence discipline, who wanted to take part in a digital evidence program, could join the General Section of the Academy. From there, a separate section might be formed.Chaos and Certification of Digital Evidence ExaminersI believe that the ultimate organization of this diverse community lies with professional certification, covering all aspects of digital evidence. The issues of good science and lawfulInternational Journal o
