As the Public Deliverable 3.1 Report on Existing Practices and Standards V1.0 of FORMOBILE shows, the standards and working procedures connected with Mobile Forensics vary from country to country. There are several key standards many countries follow, for example, ISO 17025. However, much of the #DFIR community feel that this standard does not reflect Mobile Forensics' fast-paced, ever-changing environment, which was also the motivation behind a recent publication - Six Steps to Mobile Validation – Working Together for the Common Good facilitated through SANS.
Members of FORMOBILE also share these sentiments and set off on a quest to prepare a CEN Workshop Agreement (CWA) that better reflects the reality of the domain. Moreover, the goal was to design a document that would support professionals across the entire investigation chain - from acquiring a device to producing court-proof digital evidence to support a case - helping to deliver justice by proving someone's innocence or guilt.
Thus, the FORMOBILE team and many key actors from the digital forensics community have collaborated on a document draft that will hopefully be widely adopted across the EU and further afield once completed.
A hugely experienced CWA working group - consisting of over 50 members with broad geographic coverage - has cooperated through a sequence of meetings to prepare the current draft document. There was also an open commenting phase for the draft document and comments were received from 19 organisations, incl. LEAs not participating directly in the CWA working group. The standardised working procedure covers good practices spanning the complete end to end investigation chain for mobile phones. The document's focus covers Processes, Personnel, Tools and Legal matters.
The latest round of comments did not produce many new recommendations for change - encouraging feedback that the document is going in the right direction.
Although the CWA is not an official standard that law enforcement agencies (LEAs) must follow, we are hopeful it will be well-received across the DFIR community. The team is also exploring opportunities to initiate a formal ISO or EU standard that builds on the foundations of the CWA.
LEAs will play another crucial role in the development process by validating the document in future training activities executed in FORMOBILE. Once future feedback has been reviewed and integrated into the final version, the team is highly hopeful that the resulting CWA will provide an extremely useful solution. The final version – expected to be published in March or April 2022 – should support consistency and harmony across an increasingly vital aspect of modern law enforcement and criminal justice.
FORMOBILE is a three-year project funded through the EU's Horizon2020 programme. To remain updated about the project's results and to hear about new developments moulding the future of mobile forensics - join the FORMOBILE community.