14 May 2010.ppt

Summary Observations Tools that have been tested so far don’t report data that isn’t there. Tools tend to have minor problems, usually omitting data, sometimes duplicating existing data. Digital forensic tools are being independently tested by several organizations. Conclusions of a test report only apply to the tool version tested. Any change to a tool or run environment requires retesting. Error rates can often be stated for algorithms, but not for implementations. Most digital forensic tool functions are simple collection, extraction or searching operations with a zero error rate for the algorithm. An implementation may have systematic errors that can be revealed by tool testing programs. 14 May 2010 Montana Supreme Court Spring Training Conference * Resources /dcci/dcciCyberFiles.php John Robert Taylor (1999). An Introduction to Error Analysis: The Study of Uncertainties in Physical Measurements. University Science Books ISBN?093570275X. 14 May 2010 Montana Supreme Court Spring Training Conference * Contact Information 2/26/10 AAFS * Sue Ballou, Office of Law Enforcement Standards Steering Committee representative for State/Local Law Enforcement Susan.ballou@ Jim Lyle jlyle@ * * * * * * * * * * * * * Montana Supreme Court Spring Training Conference 14 May 2010 Montana Supreme Court Spring Training Conference * Verification of Digital Forensic Tools Jim Lyle Project Leader: Computer Forensic Tool Testing (CFTT) Information Technology Laboratory National Institute of Standards and Technology 14 May 2010 Montana Supreme Court Spring Training Conference * Disclaimer Certain trade names and company products are mentioned in the text or identified. In no case does such identification imply recommendation or endorsement by the National Institute of Standards and Technology, nor does it imply that the products are necessarily the best available for the purpose. 14 May 2010 Montana Supreme Court Spring Training Conference * Introduction The computer is ubiquitou