OIC-CERT Journal of Cyber Security

Volume 3, Issue 1 (April 2021)

1-6

Practical Guideline for Digital Forensics Laboratory

Accreditation – A Case Study
Sarah Taylor, AkmalSuriani Mohamed Rakof, and Mohd Zabri Adil Talib
Digital Forensics Department, CyberSecurity Malaysia, Cyberjaya, Malaysia
[email protected]

ARTICLE INFO ABSTRACT

Article History Digital forensics is a branch of forensic science that is used

Received 04 Feb 2020 to assist investigation of cybercrime cases. Digital evidence,
Received in revised such as from mobile devices and computers, are analysed
form 07 Dec 2020 and the data are interpreted to assist the court of law in
Accepted 08 Mar 2021 understanding what has taken place. In order to provide an
assurance to the stakeholder on the accuracy of the forensic
result, ISO/IEC 17025 has been used by forensic
accreditation bodies to accredit laboratories. This paper,
presents the case study in getting a digital forensics
Keywords: laboratory accreditation, the methodology, and the lesson
Digital forensics; learnt. This paper is hoped to provide guidance to those who
Digital forensics would like to pursue accreditation for their Digital Forensics
accreditation; Laboratories (DFL).
Forensic lab
management

I. INTRODUCTION Digital forensics is used in

investigation of crime cases. The
Digital forensics is defined as the digital evidence is analysed and the
use of scientifically derived and data are interpreted to assist the court
proven methods toward the of law in understanding what has
preservation, collection, validation, taken place.
identification, analysis, interpretation,
documentation, and presentation of In order to provide an assurance to
digital evidence. These evidences are the stakeholders on the accuracy of
derived from digital sources for the the forensic results, a standard is
purpose of facilitating or furthering applied to the work produced by a
the reconstruction of events found to laboratory [2][3][4]. A notable
be criminal or helping to anticipate standard for digital forensics
unauthorized actions shown to be laboratory (DFL) is the ISO/IEC
disruptive to planned operations [1]. 17025 [5].

This paper aims at presenting a case

1 ISSN 2636-9680
eISSN 2682-9266
OIC-CERT Journal of Cyber Security
Volume 3, Issue 1 (April 2021)

study in obtaining accreditation for iv) Process Requirement

DFL. The work provides the following v) Management System
contributions: Requirement

• Methodology on getting ISO/IEC

17025:2017
accreditation. General
+
• Lessons learnt in the journey of requirements for the
Requireme
competence of
obtaining accreditation in order testing and
nt

to increase the success rate. calibration

A standard offered to any Due to the criticality of

laboratory that performs forensic laboratory,
II. BACKGROUND testing or calibration. It
outlines 5 main
accreditation body has
added extra
requirements – (i) General, requirements that need
(ii) Structural, (iii) Resource, to be fulfilled by DFL
A. Overview of the ISO/IEC 17025 (iv) Process, (vi)
Management system

The ISO/IEC 17025 General Fig. 1: Digital Forensics Laboratory (DFL)

accreditation based on ISO/IEC 17025:2017
Requirement for the Competence of standard and accrediting body’s supplemental
Testing and Calibration Laboratories requirement
specifies the requirements for a
laboratory to perform its works [6]. The General Requirement
This standard is applicable to all addresses confidentiality and
testing and calibration laboratories impartiality statements. The
regardless of the number of personnel Structural Requirement, on the other
or the extent of the scope of testing hand, addresses the legality of the
and / or calibration activities. laboratory and overall responsibility
of the lab and its organization. The
Since this standard is meant for Resource Requirement specifies the
any laboratories, generally it is not requirement for personnel, laboratory
sufficient for a DFL. Hence environment, equipment, and
accreditation bodies, such as the contractors. Meanwhile, the Process
ANSI National Accreditation Board Requirement touches on request from
(ANAB) from USA [7] and the stakeholder, methods, exhibits,
Department of Standards Malaysia reporting of results, complaints,
[8], produced supplemental nonconforming works, and control of
requirements specifically for DFLs to data. The last requirement, the
fill in the gaps. This document adds Management System, addresses risk
critical requirement such as chain of management, corrective actions,
custody and the requirement for the internal audits, and management
proficiency of analysts. review.

This ISO outlines 5 major B. Overview of accreditation

requirements for DFL as follows:
The ISO standard can be applied in
i) General Requirement DFL through self-regulation or
ii) Structural Requirement accreditation [9]. Self-regulation
iii) Resource Requirement depends on self-assessment and
ISSN 2636-9680 2
eISSN 2682-9266
 OIC-CERT Journal of Cyber Security
Volume 3, Issue 1 (April 2021)

attestation. Accreditation refers to the happening. The ISO 17025

formal recognition by an independent accreditation, in general, does provide
body, known as the Accreditation a minimal quality assurance for DFL.
Body, using technical experts that a
DFL operates according to ISO/IEC C. Overview of Case Study
17025. ANAB [10] and the American
Association for Laboratory The Digital Forensics
Accreditation (A2LA) [11] from US, Department of CyberSecurity
the National Association of Testing Malaysia has successfully obtained
Authorities (NATA) [12] from accreditation from the US
Australia, and the United Kingdom accreditation body in 2011. The
Accreditation Service (UKAS) [13] from department has also successfully
United Kingdom are examples of maintained its accreditation status
accreditation bodies. until now.

Since the issuance of

In US, a consensus regarding accreditation, it was observed that
accreditation has been reached analysts were able to answer
through the summary of 13 questions in court more confidently
recommendations made in the 2009 and less mistakes were made
National Research Council report particularly human error such as
entitled “Strengthening Forensic grammatical erroneous in reports
Science in the United States: A Path due to improper quality assurance in
Forward”. Among the place.
recommendations are to mandate
accreditation for all laboratories and In 2016, CyberSecurity Malaysia
facilities (public or private) and received a request from a middle east
mandate individual certification of country to provide consultancy
forensic science professionals [14], services in obtaining ISO/IEC 17025
depicting the importance of obtaining accreditation. Not only have the
an accreditation. agency successfully obtained the
accreditation for the Client, but it has
According to J. Kolowski [15], with also successfully obtained it in just 14
accreditation, DFL is able to put a months. The process of obtaining the
quality system in place and accreditation will be explained in
operational; demonstrating to section III.
stakeholders that the work is in good
quality and provides a sense of
assurance that work is done right. III. METHODOLOGY

Considering the erroneous The methodology that was used

convictions associate with the report for obtaining the accreditation
from forensic scientist [16], which involves 8 major phases. Fig 2 shows
have caused lasting effects on the phases in a nutshell.
people’s lives, one might consider
implementing a quality assurance in The first phase was conducting
place to prevent such case from user requirement study. In this phase,

3 ISSN 2636-9680
eISSN 2682-9266
OIC-CERT Journal of Cyber Security
Volume 3, Issue 1 (April 2021)

gaps between current practices and can they be assigned with forensic
ISO requirements were identified and cases. The test took a week. All the
presented in a report. This process analysts of the Client’s organization
took 2 weeks. have passed the test.

The next phase was to develop the With the process there and the
forensic process in writing. The analysts have been trained with the
documents that need to be developed process, next was to implement the
were quality manuals, policies, process. During this period, the Client
procedures, technical procedures, and must implement the forensic
forms. Input from analysts were processes by themselves. Records
heavily sought in order to create an must be created in order for the
adaptable process flow. Creativity in accrediting body to assess the
developing a short process flow, and implementation.
covers all essential forensic elements
was crucial. The whole process took 8 Phase 6 was the Client undergoing
weeks to complete. an internal audit. Three (3) auditors
have been assigned to audit the
Client’s laboratory to ensure
compliance with the ISO standard.
The audit took 1 week, and the auditor
took another week to produce the
audit report. At the end of 2 weeks,
the report was submitted to the Client.

Next, during Phase 7, the Client

conducted the remedial phase based
on the findings observed during the
internal audit. In this phase, the
laboratory must resolve issues raised
by the auditors. Our Client thankfully
did not encounter major issues, hence
remedial works took a short period of
Fig. 2: Methodology of obtaining ISO/IEC 1702 time, which was only 2 weeks.
accreditation

At the end of the process, an

Once the forensic process has been
application for accreditation was
laid out, next phase was a training
submitted to the accrediting body. In
session with the analysts. This
order to assess DFL readiness, the lab
process took 2 weeks and it was
needs to submit the written forensic
conducted concurrently with the
process and internal audit report. Once
Competency Test. It is a supplemental
they are satisfied with the developed
requirement from accrediting body documents, two (2) external auditors
that the organization must conduct a were sent by the accrediting body to
Competency Test for all its analysts to observe implementation onsite. No
assess their competency level. Only major issues were observed by the
when the analyst has passed the test auditors, and hence accreditation was
ISSN 2636-9680 4
eISSN 2682-9266
 OIC-CERT Journal of Cyber Security
Volume 3, Issue 1 (April 2021)

issued to our Client. This whole documented so that the auditors and
process took 2 months to settle. In assessors could evaluate the works.
overall, it took our Client 14 months
to obtain accreditation from the first The fourth observation was strong
engagement with CyberSecurity commitment and cooperation from
Malaysia. the Client in order to keep up with the
planned schedule. In this case, the
Client had provided full commitment
IV. DISCUSSION towards the plan and hence the success
in obtaining accreditation in short
Based on the observation of the period of time.
whole accreditation process, it was
found that it was doable to get
accreditation in a short period of time, V. CONCLUSION
provided the lab is coached by
experience personnel. The This paper presented a practical
observations on other labs, particularly guide in obtaining ISO 17025 digital
CyberSecurity Malaysia, on average it forensic lab accreditation. The
took between 3 to 5 years before a lab is methodology as well as the lessons
awarded an accreditation. With the learnt throughout the whole journey
developed methodology, were listed. Future work would be to
CyberSecurity Malaysia was able to measure the effectiveness of having
shorten the duration to get the Client’s accreditation in a DFL.
lab accredited.

Second observation is that any labs VI. REFERENCES

that would like to pursue accreditation
must undergo ISO 17025 training, [1] G. Palmer, “A Road Map for
including the senior management. This Digital Forensic Research,”
is important because without a good First Digit. Forensic Res.
basic understanding of the ISO Work., pp. 27–30, 2001.
[2] H. Guo and J. Hou, “Review of
requirements, the implementation
the accreditation of digital
becomes difficult. For the analyst, forensics in China,” Forensic
when implementation was first Sci. Res., vol. 3, no. 3, pp. 194–
introduced, they were having a hard 201, 2018,
time in understanding the extra work doi:
that they need to do. With basic ISO 10.1080/20961790.2018.1503
training, it will assist the management 526.
in explaining its importance and for [3] A. M. Marshall and R. Paige,
analyst to understand the relevancy of “Requirements in digital
the works. forensics method definition:
Observations from a UK
study,” Digit. Investig., vol.
Third observation was that in order 27, pp. 23–29, 2018, doi:
for the internal and external auditors to 10.1016/j.diin.2018.09.004.
audit the lab work, the lab must have [4] C. McCartney and E. Nsiah
real cases. These cases must be Amoako, “Accreditation of

5 ISSN 2636-9680
eISSN 2682-9266
OIC-CERT Journal of Cyber Security
Volume 3, Issue 1 (April 2021)

forensic science service information/accreditation-

providers,” J. Forensic Leg. criteria-and- guidance/nata-
Med., vol. 65, no. April, pp. accreditation-criteria-nac-
143–145, 2019, doi: packages/laboratory-
10.1016/j.jflm.2019.04.004. accreditation-iso-iec-
[5] E. H. Al Hanaei and A. Rashid, 17025/category/20-legal.
“DF-C2M2: A capability [Accessed: 04- Feb-2020].
maturity model for digital [13] “Forensics.” [Online].
forensics organisations,” Proc. Available:
- IEEE Symp. Secur. Priv., vol. https://www.ukas.com/servic
2014-Janua, pp. 57–60, 2014, es/accreditati on-
doi: 10.1109/SPW.2014.17. services/laboratory-
[6] ISO/IEC 17025, “ISO/IEC accreditation- isoiec-
17025:2017 General 17025/forensics/. [Accessed:
Requirement for the 04- Feb-2020].
Competence of Testing and [14] J. M. Butler, “U.S. initiatives
Calibration Laboratories,” Int. to strengthen forensic science
Organ. Stand., vol. 2017, pp. & international standards in
1–38, 2017. forensic DNA,” Forensic Sci.
[7] “Accreditation Requirements : Int. Genet., vol. 18, no.
ISO/IEC 17025:2017 Forensic January 2007, pp. 4–20,
Science Testing and 2015, doi:
Calibration Laboratories,” 10.1016/j.fsigen.2015.06.008
2019. .
[8] “Specific Criteria 1.1 (SC 1.1) [15] J. Kolowski, “The Challenge
Specific Criteria for of Accreditation for Forensic
Accreditation of Forensic Laboratories within the
Science Testing,” 2007. Good/Fast/Cheap
[9] L. Wilson-Wilde, “The Performance Management
international development of Paradigm,” Foresic Res.
forensic science standards. A Criminol. Int. J., vol. 1, no. 1,
review,” Forensic Sci. Int., vol. pp. 2–3, 2015, doi:
288, pp.1–9, 2018, doi: 10.15406/frcij.2015.01.0000
10.1016/j 1.
.forsciint.2018.04.009. [16] G. M. LaPorte, “Wrongful
[10] “Forensic Accreditation.” Convictions and DNA
[Online]. Available: Exonerations: Understanding
https://anab.ansi.org/forensic- the Role of Forensic
accreditation. [Accessed: 04- Science,” Natl. Inst. Justice
Feb-2020]. J., no. 279, p. 16, 2018
[11] “Forensic Examination
Accreditation Program.”
[Online]. Available:
https://www.a2la.org/accredit
ation/forensics. [Accessed:
04-Feb-2020].
[12] “NATA accreditation in
Forensic Science.” [Online].
Available:
https://www.nata.com.au/acc
reditation-
ISSN 2636-9680 6
eISSN 2682-9266