Beoordelingskader Digitaal Forensisch Onderzoek

Publicatie | 09-06-2022

Rapporterende forensisch deskundigen spelen een cruciale rol in de rechtspraak. Het NRGD ziet het als zijn taak dat belanghebbenden gerechtvaardigd vertrouwen kunnen hebben in forensische expertise. Dit vertrouwen moet kunnen worden gebaseerd op aantoonbaar onafhankelijk gewaarborgde kwaliteit van de forensisch onderzoeker en diens rapportages aan de hand van (inter-)nationale forensisch-specifieke normen.

Part I. General Introduction to Standards

Reporting forensic experts play a crucial role in the administration of justice. The NRGD aims to ensure justified confidence in forensic expertise for stakeholders. This confidence must be based on the demonstrable independently safeguarded quality of forensic investigators and their reports on the basis of (inter)national forensic-specific standards.

The NRGD is managed by the Court Experts Board (hereinafter: Board). The Board’s core task is to rule on the applications for registration or repeat registration in the register of the NRGD (register). To that end the Board first defines the field of expertise. This is important in order to inform applicants, assessors and users of the register (e.g. judge, public prosecutor and attorney) about the activities an expert in the field of expertise in question engages in and about the activities that fall outside the field of expertise. The demarcation of the field of expertise is set out in Part II of these Standards.

The Board also determines the criteria on the basis of which an assessment is made for each field of expertise as to whether an application complies with the quality requirements. The generic requirements are set out in the Register of Court Experts in Criminal Cases Decree (Besluit register deskundige in strafzaken). These requirements are elaborated further for each field of expertise. This elaboration is set out in Part III of these Standards.

Furthermore the Board determines the assessment procedure. This procedure is described in Part IV of these Standards.

The NRGD has a system of periodic repeat registration. Court experts must demonstrate every four years that they still meet the requirements in force at that time. The Standards are dynamic and are being developed further in order to enhance the quality of the experts. These Standards set out the current state of the (sub-)field of expertise.

The NRGD distinguishes two types of applicants: the initial applicant and the repeat applicant. The initial applicant is a reporter who at the time of submission of the application is not yet registered in the register for the field of expertise to which the application relates. The repeat applicant is an expert who is already registered in the register for the field of expertise to which the application relates.

These two types of applicants are subdivided as follows:

Initial applicant

independent reporter: a reporter who has independently written and signed the required number of case reports;
reporter without work of his own: a reporter who has not independently written and signed the number of case reports required for registration.

If the assessment is favourable, the reporter without work of his own will only qualify for provisional registration.

Repeat applicant

Repeat applicant after full registration;
Repeat applicant after provisional registration.

The initial applicant is an applicant who at the time of submission of the application does not have an NRGD registration. An initial applicant could be:

the independently reporting expert;
the newly-trained expert;
the applicant whose earlier application has been rejected by the Board;
the applicant whose registration was previously stricken.

In respect of initial applicants, it is necessary to make a clear distinction between the independent reporter and the reporter without work of his own. An example of a reporter without work of his own is the newly-trained expert. This expert has completed the forensic training, but has not yet been able to independently write the number of reports required for the assessment because these are written under the supervision of a tutor during the training. Another example of a reporter without work of his own is the reporter whose earlier application was rejected and who has been working (partly) under supervision following this rejection.

The Board adopts the following principle. Every applicant must draw up a List of Case Information. This list must include a specific number of cases in a period specified by the Board immediately preceding the application. If the List of Case Information includes one or more cases which have been prepared under supervision, the applicant will be qualified as a ‘reporter without work of his own’. Additional requirements apply to the applicant whose application was rejected earlier: the case reports must have been drawn up after the date of the Board’s decision rejecting the earlier application (Policy Framework for Application after Rejection).

The distinction between the various types of repeat applicants is important in the context of the assessment procedure: the documents a repeat applicant must submit, the composition of the Advisory Committee on Assessment and the assessment method.

The Standards are valid from the date shown on the cover. The validity runs until the moment of publication of a new version. In principle it will be checked annually as being up to date. This check can lead to a new version. The aim is to publish the new version no more than once a year. Intermediate alterations can be incorporated in an addendum, which will be published on the NRGD website as well.

All changes made to the Standards lead to a new version. Newer versions of (parts of) the Standards are designated with a higher version number.

5.1. Version management

In the case of editorial changes the old version number is increased by 0.1. Editorial changes have no substantive impact. In the case of substantive changes the version number is increased by 1.

5.2. Formal revision history

The revision history starts with version 1.0 as the first formally approved version. Substantive changes made are briefly described in the revision history (Annex C). This makes it possible to trace at all times which Standards are valid at any given moment.

Part II. Demarcation of Digital Forensics

The Digital Forensics field of expertise is described below.

Experts within the Digital Forensics field of expertise deal with digital material. Digital material covers all manifestations, input, output and processing of digital systems. A digital system processes information in discrete units. This contrasts to an analogue system in which a continuous representation of information is present. Digital material can occur in various sources, and the Digital Forensics field of expertise is characterised by a growing number of potential sources. This can be software, hardware or a combination of both.

Digital Forensics seek to examine - depending on the precise question posed - whether discovered digital evidence can be linked to natural persons. In order to achieve this, an expert will in principle carry out a reconstruction of how digital evidence ended up on the material to be examined.

Experts in the Digital Forensics field of expertise are in principle able to carry out every phase of Digital Forensics (data collection, data examination and data analysis) themselves. An expert can have parts of the data collection, data examination or data analysis phases carried out by someone else (please see the Code of Conduct of the Netherlands Register of Court Expert).

The activities which fall within the Digital Forensics field of expertise are:

Data collection: Data collection involves the correct preservation (e.g. by copying) of digital data sources. Collection either means securing the original or taking a forensic copy of the data. Preservation implies the digital evidence is preserved so that it can be collected later (if necessary). For example, a company can be asked to preserve existing backup tapes by ensuring they are no longer recycled. If necessary they can be collected later. Knowledge of the following areas amongst others is thereby crucial: digital storage media (hard disks, multimedia memories etc.), data communications, mobile phones, and embedded digital devices. In this phase an expert must be familiar with the various collection options, and he must be able to assess which collection option should be applied to a specific case. The expert must also have knowledge of the possible locations where evidence might be found. Finally the expert needs to know what knowledge and/or skills are required in order to safeguard evidence and minimise the impact on the source material.
Data examination: Data examination relates to the investigation of forensic images of digital data sources in order to find potential evidentiary data. without interpreting the resultant findings in the context of the case. It may thereby be possible that the expert sets up their own experiment. In this phase the expert must be able to differentiate which evidence may and may not be relevant, and the expert must make this evidence suitable for in-depth analysis.
Data analysis: Data analysis involves the analysis, reconstruction, interpretation and providing a qualitative opinion of the evidence which is obtained from the digital data sources. In this phase the expert must be able to make a substantiated assessment. Interpreting is the crucial activity that sets data analysis apart from data examination.

The type of question coming from the court of law depends on the phase which the digital forensic examination has reached.

Questions in the data collection phase

The following questions - amongst others - are relevant for the data collection phase within the Digital Forensics field of expertise:

Is the electronic equipment correctly secured?
Is the bypassing of the access code correctly carried out?
Is the data correctly safeguarded out of complex infrastructures like industrial control systems?
Was the data preserved using validated tools and methods?
Was the data preserved using appropriate forensic image formats?
Was the preservation carried out in a manner that ensured minimum contamination?
How did you validate the tools that you used?
Did you use the appropriate legal authority to preserve the digital evidence?

Questions in the data examination phase

The following questions - amongst others - are relevant for the data examination phase within the Digital Forensics field of expertise:

What data concerning the event in question can be found on what exhibit, what is the location of the data and by what means can it be retrieved?
Was the data accessible by use of software available to the suspect?
Can it be ascertained when the retrieved data has been stored on the data storage, when the data has been accessed, modified and/or changed?
In case of deleted information like text messages, photos and videos, has such information been correctly retrieved?
Is the exchange of data, captured in a network trace, correctly made visible?
Has the tool that you used correctly parsed out the data from the artefact that you are examining, and how can you confirm that this was the case?
What hypothesis can be generated from the digital evidence examined?

Questions in the data analysis phase

The following questions - amongst others - are relevant for the data analysis phase within the Digital Forensics field of expertise:

Questions relating to reconstruction

Is digital evidence present on the material to be examined?
What is the nature of the digital evidence on the material to be examined?
How did the digital evidence end up on the material to be examined?
What is the chronological and/or temporal sequence of events that can be determined from the analysis of the digital evidence?
Can any user attribution be determined from the digital evidence analysed?
Can the digital evidence analysed place the device at a particular physical location, and potentially at a particular time?

These questions are aimed at providing a reliable reconstruction of how digital evidence ended up on the material to be examined. After all, digital evidence can be produced in various ways.

Questions relating to interpretation

To what extent does the digital evidence analysed support any of the hypotheses generated?
Does the analysed digital evidence suggest any alternative hypothesis that needs to be examined?
To what extent does the analysed evidence support any of the legal elements of the matter under investigation?

Questions aimed at providing a qualitative opinion

How much knowledge and skill in the field of digital technology is required in order to achieve a particular result?
Is a particular event or action technically difficult?

These can be follow-up questions to the reconstruction questions and are particularly aimed at providing clarity about the extent to which a particular event or action can be attributed to a person.

The applicant can adopt different models of rational legal approaches; e.g. Bayesian models, story- based models or argumentation-based models, since different questions may require different approaches. Part of the expertise is to extend a known or a newly developed methodology to a new case. Newly developed methodology should be validated on reference devices or test systems before adopting it to the actual case.

It is important that an expert is able to identify the limits of his expertise and act accordingly. This means that an expert must be able to recognise immediately that his own expertise or specialism is not adequate to carry out the digital forensic examination.

Interpretation that extends outside of the digital field does not come under the Digital Forensics field of expertise. Examples of activities that emphatically do not come under the Digital Forensics field of expertise are:

Identification and comparison of persons and/or objects that might be visible on image fragments;
Interpreting what might be audible on audio fragments;
Interpreting what might be possible with an electronic analogue circuit;
Measurements in (image) fragments;
Photogrammetry: Determine the position/velocity of the vehicle?
Facial comparison: Is the robber the same person as the suspect?
Speaker recognition: Is the speaker in conversation (a) the same person as the speaker in conversation(b)?
Crime scene visualisation.

5.1. Registration

The register lists the expert concerned as an expert in the field of Digital Forensics.

5.2. Defined sub-fields

Experts in the field of Digital Forensics have a shared knowledge of IT, which is supplemented with knowledge of at least one subfield. Knowledge in these areas changes rapidly. In view of this, the expert will be assessed based on the registration requirement (part III) and according to the assessment procedure (part IV) on the shared knowledge of IT and on the subfield(s).

The NRGD distinguishes the following subfields within the field of Digital Forensics. The expert must stipulate the subfield(s) from at least one of the categories below:

008.0 Digital Forensics
008.1 Computer Forensics
008.2 Software Forensics
008.3 Database Forensics
008.4 Multimedia Forensics
008.5 Device Forensics
008.6 Network Forensics

5.3. The subfields further explained

The ontology and the explanation is based on Karie, N. M. and Venter, H. S. (2014), Toward a General Ontology for Digital Forensic Disciplines. Journal of Forensic Sciences, 59: 1231–1241 and on Henseler, H. and Loenhout, S. van (2018). Educating judges, prosecutors and lawyers in the use of digital forensic experts. Digital Investigation, 24: S76-S82.

Computer forensics

Computer forensics uses validated analysis techniques to gather potential evidence from storage media (such as a hard disk), RAM and other parts of desktops, laptops and server computers. For instance, traces of internet browsers or presence of certain file types (emails, documents, pictures etcetera). The investigation can also address questions about the manipulation of traces or their time stamps.