Mobile devices represent a unique challenge for law enforcement. Due to their wide use, they underpin many criminal investigations. Moreover, criminal offenders, organised crime and terrorist organisations use mobile devices for various purposes, which faces criminal prosecution with many challenges. Law enforcement need not only to access the data stored on mobile devices, but also to provide it as court evidence in a trustworthy and reliable manner.
Adherence to common standards and specifications during all steps of investigation in this field is of critical importance for the evidence gathered to be regarded as reliable and acceptable to the court. Despite the relatively large number of standards and non-formal standardization documents, relevant for IT security and digital investigation, there is a general lack of specific standards for mobile forensics.
In this context, CEN published new CWA 17865:2022 'Requirements and Guidelines for a complete end-to-end mobile forensic investigation chain'. The purpose of this document is to provide recommendations for a complete forensic investigation chain targeting mobile devices. The CWA covers good practices for the mobile phone forensics chain, tools for the acquisition, recovery, analysis and visualisation of data, as well as the necessary training required to effectively use the new tools and successfully follow the good practices.
This CWA documents good practice guidance for the correct and necessary processes, competencies and methods required to ensure the admissibility of evidence. It provides a set of guidelines that fit within the wider context of digital forensic investigations for law enforcement in general at the level of specificity, necessary to keep these guidelines meaningful, whilst simultaneously avoiding such details that make them quickly obsolete. It is intended to be complementary to existing related standards within the digital forensics sphere.
The work on this CWA was initiated by the FORMOBILE European Project: it is a consortium of partners working to create an end-to-end mobile forensic investigation chain and striving to improve digital safety and security in the EU while respecting fundamental rights. The FORMOBILE European Project is a research project funded by Horizon 2020.
CWA 17865 was developed by CEN/WS FORMOBILE, whose Secretariat is held by ASI, Austrian Standards International.
Dr. Christian Hummert, Research Director at Agentur für Innovation in der Cybersicherheit, commented: “It is of utmost importance that forensic examinations of cell phones in the EU are standardized and that the results are comparable between countries. The new CWA will take this to a beyond state-of-the-art level.”
Mike Dickinson - Chief Business Development Officer (CBDO) at MSAB and a participant to the Workshop, added: “We know mobile forensic tool users have struggled for some time to find a suitable standards document that provides guidance on the process, use and validation of tools. I believe CEN/CWA 17865:2022 is a breakthrough document that achieves this objective, whilst simultaneously offering the flexibility to deal with rapid changes to smartphones in the future.”
CWA 17865:2022 is freely available for download here.
Catherine VIGNERON
cvigneron@cencenelec.eu
