Research • DOI
Verifying digital findings: three publications with DOI links
A commented reading list on mobile forensic methods, interpretation and test datasets.
Method: NIST SP 800-101 Rev. 1
Ayers, Brothers and Jansen (2014) describe a mobile evidence workflow from preservation to reporting. Read it as a methodological foundation with its age in mind. Support for a particular device, operating system and application needs separate verification.
Interpretation: VODE
Horsman (2019) proposes a framework supporting the testing and verification of digital data interpretations. Practical comment: a report’s field label should not end the analysis. For a material finding, check the field’s meaning in the relevant application version and document the basis of that interpretation.
Testing: dataset quality
Lyle and Horsman (2021) examine challenges in constructing test datasets. Poor documentation weakens the value of a test. Practical comment: ask whether the expected result was known, which scenarios were covered and whether the conditions matched the problem under examination.
Using the literature
A DOI identifies a publication; it does not certify software or an individual expert opinion. Link references to specific methodological decisions in the examination record. The bibliography distinguishes the NIST technical guide from journal articles. Original publication titles are retained to make sources easier to find.
Sources and further reading
- Ayers, R.; Brothers, S.; Jansen, W. (2014). Guidelines on Mobile Device Forensics. NIST SP 800-101 Rev. 1. DOI: 10.6028/NIST.SP.800-101r1
- Horsman, G. (2019). Part 1: Quality assurance mechanisms for digital forensic investigations: Introducing the Verification of Digital Evidence (VODE) framework. Forensic Science International: Reports, 100038. DOI: 10.1016/j.fsir.2019.100038
- Lyle, J. R.; Horsman, G. (2021). Dataset construction challenges for digital forensics. Forensic Science International: Digital Investigation, 38, 301264. DOI: 10.1016/j.fsidi.2021.301264
Educational material about Polish proceedings and digital forensics. Individual cases require examination of their records. Translations do not change the jurisdiction of the legislation discussed.
Discuss an expert assessment →