The purpose of this practice is to describe techniques and procedures for computer forensics in regard to evidence handling, computers, digital imaging, and forensic analysis and examination.

The examiner should be trained in accordance with Guide E2678.

Individuals not trained in proper digital evidence procedures should consult with an appropriate specialist before proceeding.

When dealing with technology outside your area of expertise, consult with an appropriate specialist before proceeding.

1. Scope

1.1 This practice describes techniques and procedures for computer forensics within the context of a criminal investigation.

1.1.1 This practice can be applicable to civil litigation.

1.2 This practice describes seizing possible evidence, proper evidence handling, digital imaging, forensic analysis/examination, evidence-handling documentation, and reporting.

1.3 This practice is not all inclusive and does not contain information relative to specific operating systems or forensic tools.

1.4 The values stated in SI units are to be regarded as standard. No other units of measurement are included in this standard.

1.5 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety and health practices and determine the applicability of regulatory limitations prior to use.

2. Referenced Documents (purchase separately) The documents listed below are referenced within the subject standard but are not provided as part of the standard.

ASTM Standards

E2678 Guide for Education and Training in Computer Forensics

SWGDE Standards

Keywords

computer data; computer forensic analysis; computer forensics; computers; evidence; software; volatile memory;

ICS Code

ICS Number Code 13.310 (Protection against crime); 35.080 (Software)

Citing ASTM Standards

[Back to Top]