ISO (or the International Organization for Standardization) is an international body that tries to define best practices with regard to the operation of various workflows. This can be something as simple as define how to examine a HD for acceptance into courts of law to something as great as ISO 9001 (which defines the formal business practices).
One needs to understand the ISO tries to define best practice and while that may be good enough to 90% of the time… it is after all a best practice and there may be situations that require other methods for getting the job done. Forensics is all about system collection of data. If we can valid that the data was collected cleanly, if we can confirm consistent results to the acquisition, validation, extraction and reconstruction of the data then it really doesn’t matter whether you’ve used an ISO standard or NOT. BUT if one deviates from an ISO standard one needs to be able to explain to a jury in non technical terms that the above mentioned process to meticulous and in criminal cases this needs to be proven without doubt. This is not always achievable and thus stick with ISO standards may help you convince a jury though may not always be the easiest/fastest way to collect data.
Comments
Leave a comment Trackback