Digital forensics is causing a massive collision, if you will, between two seemingly unyielding forces: the legal system and forensic communities that operate at a relatively slow and deliberate pace versus the blinding speed of technology. Neither is built for speed. There are good reasons for that. The stakes are far too high to admit forensic evidence that hasn’t been proven reliable. This proven reliability takes time and can’t be achieved overnight.

Two technologies, cloud computing and solid state hard drives (SSDs), present substantial challenges. As it stands, digital evidence in either of these environments could very well be unrecoverable for either technical or legal reasons (or both). These technologies are in use today and represent a problem to which there is no easy answer. How all of these challenges will be met has yet to be seen.

A control is defined as “a test performed in parallel with experimental samples that is designed to demonstrate that a procedure is working correctly and the results are valid” (Barbera, 2007). In essence, a control is simply a sample that provides a known result.

That may hold true for serology, chemistry, toxicology, and the like, but its relevance to digital forensics is a matter of dispute. More traditional forensic scientists are taking the stance that standards and controls are essential for all forensic disciplines, including digital and multimedia forensics. One of the major digital forensic bodies, the Scientific Working Group on Digital Evidence (SWGDE), is taking the exact opposite position. The controversy began with an article on Forensicmag.com in 2007 by John Barbera. In the article, Barbera raised the issue of standards and controls in digital forensics. He is a crime laboratory analyst supervisor with the Florida Department of Law Enforcement (FDLE). He is also an ASCLD/LAB inspector and has been since 1993. In the article, he laid out his case, citing the mandatory use of standards and controls in every other forensic discipline. He argued that the use of standards and controls is necessary to prove that tests are performed in a scientific manner and that quality assurance measures are followed (Barbera, 2007).

In the end, closely following these established scientific practices ensures that any results gained are accurate, reliable, and repeatable. Barbera further argued that, without the use of standards and controls, it would be “extremely difficult or impossible to scientifically assess the validity of the results obtained from the analysis of the physical evidence” (Barbera, 2007). Finally, he raised the admissibility standards required by the Daubert case (Daubert v. Merrell, 1993).

In Daubert, the court said that, when considering the admissibility of any scientific evidence, the focus should be on the principles and methodology and not on the conclusions that they generate.

The SWGDE doesn’t agree. Its position is that standards are being used in digital forensics, but controls are “not applicable in the computer forensics sub-discipline” (SWGDE, 2008).

SWGDE’s position centers on false positives. It says that false positives do not exist in computer forensics. Tools and processes may miss evidence, but they will never find evidence that doesn’t exist. The main objective of any digital forensic examination, says SWGDE, is to find data that already exists relating to criminal activity. Therefore, there is no real value to the analysis or the results.

The SWGDE concludes by saying that “validation, data integrity (through hashing), and performance verification” are a more appropriate solution than the traditional use of standards and controls (SWGDE, 2008).

SWGDE agrees, saying, “New technology, typically proprietary in nature, emerges daily. As these new technologies emerge, new solutions and techniques are needed to understand and examine evidence. Comprehensive understanding and validated techniques need to move swiftly from the research community to the examiner community” (SWGDE, 2008).

Examiners presented with this situation will have to attempt to find a proven solution from others in the digital forensics community. Failing that, examiners may have to conduct the research on their own and validate the results. This takes time. Message boards (such as the one for HTCIA members) and e-mail lists are worth their weight in gold in these circumstances. They provide a ready channel for communication and problem solving.

Delivering services over the web, cloud computing’s bread and butter, represents a major shift away from the computing model that the world has grown accustomed to. Remote applications, hardware, platforms, and infrastructure have a great many benefits; reduced costs and elasticity are just two. Behind the scenes, the cloud relies heavily on virtualization and redundancy. The massive data centers used to deliver public cloud services are likely to be widely dispersed, residing in multiple states or even different countries. Meeting the legal requirements to gain access to this data can take an astronomical amount of time. It’s entirely possible that, by the time the legal burden is met, the evidence in question may no longer exist.

SSDs are another game-changing technology that must be addressed. These devices may serve the same function as our familiar magnetic drives, but they certainly don’t act like them. The storage method they use—tiny charged transistors—must be “reset” before being written to. This process slows down the drive, which affects performance. To mitigate the slowdown, drive makers have built in a process known as garbage collection. This process begins this reset process in only minutes. This procedure destroys data on the drive in such a way that current tools and techniques cannot recover it.

Digital evidence, and its associated forensic processes, is sometimes radically different from other, established disciplines. Bedrock forensic practices such as the use of standards and controls are found to be meaningless to some in the digital forensics community. Those opposed say that, unlike serology and toxicology, it simply isn’t possible to get a false-positive result from a digital forensic examination. The tool, they say, may miss some evidence, but it will never find evidence that wasn’t already there.

These are just a few of the significant challenges faced by front-line practitioners. There is much work to be done if these challenges will be met.