September (2) 2009

I enjoyed the EAFS conference very much. We organized the workshop on Digital Evidence, and it appeared that we had good attendance from experts within different fields. It remains an issue to make a good workshop were people also can do some hands on and it is not a plenary kind of thing. Of course working in smaller groups can solve this issue. I had also some time to relax in Glasgow, and discuss with colleagues on issues in forensic science.

On Friday morning I chaired a session on Digital Evidence, where Peter Sommer was the keynote speaker. He was giving an overview of the rate of change, and the issue that forensic peer reviewed articles can not follow this rate of change. So not all specific methods in digital evidence that are used in court are peer reviewed, since often one has to do research and reverse engineering to find the particular digital traces, and it is used in that specific case. So if someone would like to follow Daubert exactly, it appears that the exact method is not peer reviewed. Of course a general approach of using digital evidence is described however in digital evidence, also in guidelines of ENFSI www.enfsi.eu . A solution might be a peer review of the method during the case by other experts. Another issue is that most forensic scientist are often loaded with casework and do not have time to publish.

It was good to be at this conferences, and although the papers varied in quality, I had good discussions, and I always learn from these conferences, and see the different approaches within different law systems. The good thing that we also have within our working group is that there is a new standard being developed for collecting Digital Evidence, which should be ready in 2012. It is standard http://www.iso27001security.com/html/27037.html ISO 27037 which will be developed now. I think it is very good since very often digital evidence, such as emails and logfiles will cross borders and jurisdictions if cases are on internet.

After that I had a week to recover, and work on some casework and new Research and Development. Last Friday I went to Brussels and talked to several people of the European Commission concerning the developments in forensic IT within Europe. Also I was discussing on the program of WCIT 2010 http://www.wcit2010.com/ which also handles the rate of change, and the issues and solutions around it. The NFI is the organiser of a track within this conference, and we are looking further in this program.

Budgets are currently tighter within most forensic institutes and government agencies, so we always have to consider more efficient ways on processing forensic examination, and maintaining the high quality. It will give new solutions, and approaches, as long as long term investments are continued. Training and education is always necessary on all levels such that the law enforcement knows limitations and possibilities of forensic evidence, and of course it remains important to have good guidelines which are easy to use and easy to understand, such that important forensic evidence will not be destroyed by accident.