digital evidence standards and principles, by swgde and ioce (forensic science communications, april 2000).mht

SIM卡的文件系统以及各种相对应的流程的介绍

                =
href=3D"http://www.fbi.gov/hq/lab/fsc/backissu/april2000/swgde.htm#Commen=
ts">Comments</A></FONT></B></BLOCKQUOTE></BLOCKQUOTE></TD></TR>
        <TR>
          <TD width=3D419 bgColor=3D#cccccc height=3D"30%">
            <BLOCKQUOTE>&nbsp;<B><FONT face=3DHelvetica size=3D-1>II. <A =

              =
href=3D"http://www.fbi.gov/hq/lab/fsc/backissu/april2000/swgde.htm#Intern=
ational">International=20
              Principles for Computer =
Evidence</A></FONT></B></BLOCKQUOTE></TD></TR>
        <TR>
          <TD width=3D419 bgColor=3D#cccccc height=3D"30%">
            <BLOCKQUOTE>
              <BLOCKQUOTE><B><FONT face=3DHelvetica size=3D-1><A=20
                =
href=3D"http://www.fbi.gov/hq/lab/fsc/backissu/april2000/swgde.htm#IOCEIn=
troduction">Introduction</A></FONT></B></BLOCKQUOTE></BLOCKQUOTE></TD></T=
R>
        <TR>
          <TD width=3D419 bgColor=3D#cccccc height=3D"30%">
            <BLOCKQUOTE>
              <BLOCKQUOTE><B><FONT face=3DHelvetica size=3D-1><A=20
                =
href=3D"http://www.fbi.gov/hq/lab/fsc/backissu/april2000/swgde.htm#IOCEIn=
ternationalPrinciples">IOCE=20
                International=20
        =
Principles</A></FONT></B></BLOCKQUOTE></BLOCKQUOTE></TD></TR></TBODY></TA=
BLE></CENTER></H2>
      <H2>
      <CENTER><A name=3DProposed></A><FONT face=3DHelvetica>Proposed =
Standards for=20
      the Exchange of Digital Evidence</FONT> </CENTER></H2>
      <H2>
      <CENTER>
      <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"98%" border=3D0>
        <TBODY>
        <TR>
          <TD width=3D413>
            <P>
            <CENTER><B><FONT face=3DHelvetica size=3D-1>Scientific =
Working Group on=20
            Digital Evidence=20
      =
(SWGDE)</FONT></B></CENTER></TD></TR></TBODY></TABLE></CENTER></H2>
      <H3><A name=3DIntroduction></A><FONT =
face=3DHelvetica>Introduction</FONT></H3>
      <P><FONT face=3DHelvetica size=3D-1>The Scientific Working Group =
on Digital=20
      Evidence (SWGDE) was established in February 1998 through a =
collaborative=20
      effort of the Federal Crime Laboratory Directors. SWGDE, as the =
U.S.-based=20
      component of standardization efforts conducted by the =
International=20
      Organization on Computer Evidence (IOCE), was charged with the =
development=20
      of cross-disciplinary guidelines and standards for the recovery,=20
      preservation, and examination of digital evidence, including =
audio,=20
      imaging, and electronic devices.</FONT></P>
      <P><FONT face=3DHelvetica size=3D-1>The following document was =
drafted by=20
      SWGDE and presented at the International Hi-Tech Crime and =
Forensics=20
      Conference (IHCFC) held in London, United Kingdom, October 4-7, =
1999. It=20
      proposes the establishment of standards for the exchange of =
digital=20
      evidence between sovereign nations and is intended to elicit =
constructive=20
      discussion regarding digital evidence. This document has been =
adopted as=20
      the draft standard for U.S. law enforcement agencies.</FONT></P>
      <P><A=20
      =
href=3D"http://www.fbi.gov/hq/lab/fsc/backissu/april2000/swgde.htm#Index"=
><I><FONT=20
      face=3DHelvetica size=3D-1>Back to the top</FONT></I></A></P>
      <P><A name=3DPurpose></A><B><FONT face=3DHelvetica=20
      size=3D-1>Purpose<BR></FONT></B><FONT face=3DHelvetica =
size=3D-1><BR>The latter=20
      part of the twentieth century was marked by the electronic =
transistor and=20
      the machines and ideas made possible by it. As a result, the world =
changed=20
      from analog to digital. Although the computer reigns supreme in =
the=20
      digital domain, it is not the only digital device. An entire =
constellation=20
      of audio, video, communications, and photographic devices are =
becoming so=20
      closely associated with the computer as to have converged with=20
      it.</FONT></P>
      <P><FONT face=3DHelvetica size=3D-1>From a law enforcement =
perspective, more=20
      of the information that serves as currency in the judicial process =
is=20
      being stored, transmitted, or processed in digital form. The =
connectivity=20
      resulting from a single world economy in which the companies =
providing=20
      goods and services are truly international has enabled criminals =
to act=20
      transjurisdictionally with ease. Consequently, a perpetrator may =
be=20
      brought to justice in one jurisdiction while the digital evidence =
required=20
      to successfully prosecute the case may reside only in other=20
      jurisdictions.</FONT></P>
      <P><FONT face=3DHelvetica size=3D-1>This situation requires that =
all nations=20
      have the ability to collect and preserve digital evidence for =
their own=20
      needs as well as for the potential needs of other sovereigns. Each =

      jurisdiction has its own system of government and administration =
of=20
      justice, but in order for one country to protect itself and its =
citizens,=20
      it must be able to make use of evidence collected by other=20
      nations.</FONT></P>
      <P><FONT face=3DHelvetica size=3D-1>Though it is not reasonable to =
expect all=20
      nations to know about and abide by the precise laws and rules of =
other=20
      countries, a means that will allow the exchange of evidence must =
be found.=20
      This document is a first attempt to define the technical aspects =
of these=20
      exchanges.</FONT></P>
      <P><A=20
      =
href=3D"http://www.fbi.gov/hq/lab/fsc/backissu/april2000/swgde.htm#Index"=
><I><FONT=20
      face=3DHelvetica size=3D-1>Back to the top</FONT></I></A></P>
      <P><A name=3DOrganization></A><B><FONT face=3DHelvetica=20
      size=3D-1>Organization<BR><BR></FONT></B><FONT face=3DHelvetica =
size=3D-1>The=20
      format of this document was adopted in conformance with the format =
of the=20
      American Society of Crime Laboratory Directors/Laboratory =
Accreditation=20
      Board manual.</FONT></P>
      <H3><A name=3DDefinitions></A><FONT =
face=3DHelvetica>Definitions</FONT></H3>
      <P><I><FONT face=3DHelvetica size=3D-1>Acquisition of Digital =
Evidence:=20
      </FONT></I><FONT face=3DHelvetica size=3D-1>Begins when =
information and/or=20
      physical items are collected or stored for examination purposes. =
The term=20
      "evidence" implies that the collector of evidence is recognized by =
the=20
      courts. The process of collecting is also assumed to be a legal =
process=20
      and appropriate for rules of evidence in that locality. A data =
object or=20
      physical item only becomes evidence when so deemed by a law =
enforcement=20
      official or designee.</FONT></P>
      <P><I><FONT face=3DHelvetica size=3D-1>Data Objects: =
</FONT></I><FONT=20
      face=3DHelvetica size=3D-1>Objects or information of potential =
probative value=20
      that are associated with physical items. Data objects may occur in =

      different formats without altering the original =
information.</FONT></P>
      <P><I><FONT face=3DHelvetica size=3D-1>Digital =
Evidence:</FONT></I><FONT=20
      face=3DHelvetica size=3D-1> Information of probative value stored =
or=20
      transmitted in digital form.</FONT></P>
      <P><I><FONT face=3DHelvetica size=3D-1>Physical =
Items</FONT></I><FONT=20
      face=3DHelvetica size=3D-1>: Items on which data objects or =
information may be=20
      stored and/or through which data objects are =
transferred.</FONT></P>
      <P><I><FONT face=3DHelvetica size=3D-1>Original Digital=20
      Evidence:</FONT></I><FONT face=3DHelvetica size=3D-1> Physical =
items and the=20
      data objects associated with such items at the time of acquisition =
or=20
      seizure.</FONT></P>
      <P><I><FONT face=3DHelvetica size=3D-1>Duplicate Digital=20
      Evidence:</FONT></I><FONT face=3DHelvetica size=3D-1> An accurate =
digital=20
      reproduction of all data objects contained on an original physical =

      item.</FONT></P>
      <P><I><FONT face=3DHelvetica size=3D-1>Copy</FONT></I><FONT =
face=3DHelvetica=20
      size=3D-1>: An accurate reproduction of information contained on =
an original=20
      physical item, independent of the original physical =
item.</FONT></P>
      <P><A=20
      =
href=3D"http://www.fbi.gov/hq/lab/fsc/backissu/april2000/swgde.htm#Index"=
><I><FONT=20
      face=3DHelvetica size=3D-1>Back to the top</FONT></I></A></P>
      <H3><A name=3DStandards></A><FONT =
face=3DHelvetica>Standards</FONT></H3>
      <P><B><FONT face=3DHelvetica size=3D-1>Principle 1</FONT></B></P>
      <P><FONT face=3DHelvetica size=3D-1>In order to ensure that =
digital evidence=20
      is collected, preserved, examined, or transferred in a manner =
safeguarding=20
      the accuracy and reliability of the evidence, law enforcement and =
forensic=20
      organizations must establish and maintain an effective quality =
system.=20
      Standard Operating Procedures (SOPs) are documented =
quality-control=20
      guidelines that must be supported by proper case records and use =
broadly=20
      accepted procedures, equipment, and materials.</FONT></P>
      <P><B><FONT face=3DHelvetica size=3D-1>Standards and Criteria=20
      1.1<BR></FONT></B><FONT face=3DHelvetica size=3D-1>All agencies =
that seize=20
      and/or examine digital evidence must maintain an appropriate SOP =
document.=20
      All elements of an agency's policies and procedures concerning =
digital=20
      evidence must be clearly set forth in this SOP document, which =
must be=20
      issued under the agency's management authority.</FONT></P>
      <P><B><I><FONT face=3DHelvetica =
size=3D-1>Discussion</FONT></I></B><I><FONT=20
      face=3DHelvetica size=3D-1>.<B> </B></FONT></I><FONT =
face=3DHelvetica=20
      size=3D-1>The use of SOPs is fundamental to both law enforcement =
and=20
      forensic science. Guidelines that are consistent with scientific =
and legal=20
      principles are essential to the acceptance of results and =
conclusions by=20
      courts and other agencies. The development and implementation of =
these=20
      SOPs must be under an agency's management authority.</FONT></P>
      <P><B><FONT face=3DHelvetica size=3D-1>Standards and Criteria=20
      1.2<BR></FONT></B><FONT face=3DHelvetica size=3D-1>Agency =
management must=20
      review the SOPs on an annual basis to ensure their continued =
suitability=20
      and effectiveness.</FONT></P>
      <P><B><I><FONT face=3DHelvetica =
size=3D-1>Discussion</FONT></I></B><I><FONT=20
      face=3DHelvetica size=3D-1>.<B> </B></FONT></I><FONT =
face=3DHelvetica=20
      size=3D-1>Rapid technological changes are the hallmark of digital =
evidence,=20
      with the types, formats, and methods for seizing and examining =
digital=20
      evidence changing quickly. In order to ensure that personnel, =
training,=20
      equipment, and procedures continue to be appropriate and =
effective,=20
      management must review and update SOP documents =
annually.</FONT></P>
      <P><A=20