digital forensics
Digital Forensic PT
digital forensics

Proficiency Testing

How to gain assurance in your digital forensic processes

Digital forensic proficiency testing is a requirement of ISO/IEC 17025:2017 accreditation and is an essential means of comparing your digital forensic processes against other organisations, enabling improvements to be identified and implemented. Successful participation in regular proficiency tests provided by a credible independent PT provider, evidences to external regulatory bodies such as UKAS that the correct activities are being undertaken to maintain accreditation standards and the Forensic Science Regulator that you are complying to the statutory Code of Practice 2023.

CACI Currently offer the following Proficiency Testing Schemes

  • Computer-Based Devices – Acquisition
  • Computer-Based Devices – Processing and analysis
  • Mobile-Based Phone – Acquisition, processing and analysis

 How our scheme operates

  • Each scheme is operated in annual rounds, split into four cycles which start every third month throughout each calendar year. This provides flexibility for participants to join the cycle that best suits their timescales. Each cycle is four months long and consists of two months of participant activities and two months of CACI activities.
  • Physical test devices are sent to participants for them to conduct appropriate processes and answer questions supplied by CACI.
  • All tests are designed to mirror real-life submissions. Devices will come packaged as evidence, with a submission document allowing participants to test their full end to end processes. This includes documentation such as DPN(a) and/or DPN(c).
  • Participation in schemes is achieved via CACI’s PT portal. This grants access to key information and documentation, whilst also providing participants with status updates and support throughout the process.
  • Once complete, participants will return the test devices, their responses to the questions, contemporaneous notes and any produced or requested data to CACI for comparison against known values and other participants responses.
  • The test results are sent to participants, ensuring anonymity, using CACI’s PT portal.
  • The Final Report displays comparisons of participant performance against other participants in the same cycle. The cumulative report is published/updated following the completion of each cycle and contains comparisons against all participants who have completed the scheme.

What’s included in the scheme?

Computer Based Devices – Acquisition

This scheme will include between three and five physical devices per year of the following types:

Removable
• Hard Disk Drive (HDD)
• Solid State Drive (SSD)
• M.2 (NVMe) Storage Drive
• M.2 (SATA) Storage Drive
• USB Flash Drive
• Memory Card
• Digital Versatile Disk (DVD)
• Compact Disk (CD)
• Digital Cameras
• MP3/4 Players
• Floppy Disks

Non-Removable
• Computer – Windows – Based
• Computer – Apple Mac

The scheme will provide sufficient test items within each round to ensure that the entire scope of devices, as listed above, are provided over a four-year period. Schemes are focused on acquisition processes and related challenges, including pre-acquisition activities and more.

Participant accreditation schedules are reviewed regularly and, in conjunction with participant feedback, the above lists may be adjusted to include any changes to participants’ scope in this area.

Computer Based Devices – Processing & Analysis

This scheme consists of a forensic acquisition provided, per year, for processing and analysis of one of the following operating systems:

• Microsoft Windows
• Apple MacOS
• Linux/Unix

Over a three-year period, all operating systems will be included in the scheme. This scheme includes a full case background, examination strategy & workbook, focusing on processing, analysis and related challenges.

Participant accreditation schedules are reviewed regularly and, in conjunction with participant feedback, the above lists may be adjusted to include any changes to participants’ scope in this area.

Mobile Based Devices – Acquisition, Processing & Analysis

This scheme consists of a forensic acquisition and three physical devices of the following types, per year:

• Google Android
• Apple iOS
• Non-smartphone proprietary device
• SIM card
• Memory Card

To ensure all laboratories, including those who do not have access to certain forensic tools, are able to test their documented methods and forensic tools, sufficient test items shall be provided over a four-year period to cover known forensic tool support. For example, one year may include a proprietary device which is able to be examined using a standard forensic tool, while the next year may include a device which is only acquirable via an advanced tool.

CACI will aim to provide at least one recently released device which may only be supported by advanced acquisition tools and one older device which is compatible with standard forensic tools. CACI will continually review the support situation of mobile devices to identify suitable devices to cover known device support.

This scheme encapsulates the pre-acquisition, acquisition, processing, analysis and related challenges of the devices and includes a full case background, examination strategy and workbook.

Participant accreditation schedules are reviewed regularly and, in conjunction with participant feedback, the above lists may be adjusted.

Accreditation

CACI’s Digital Forensic Laboratory holds accreditation to ISO/IEC 17043:2023 for the following Proficiency Testing Scheme.

  • Computer-Based Devices – Acquisition
  • Computer-Based Devices – Processing & Analysis
  • Mobile-Based Devices – Acquisition, Processing & Analysis

To ensure compliance with The Forensic Science Regulators Code of Practice, and ensure quality of all Digital Forensics Investigation and Proficiency Testing services, UKAS has also granted CACI with accreditation to ISO/IEC 17025:2017 with compliance to ILAC G19:06/2022 and Forensic Science Regulator Code of Practice Version 1 for digital forensic testing activities used throughout the delivery of both our Proficiency Testing and Investigation services.

Please access our schedules of accreditation to see our current scope of accreditation:

In addition, CACI’s Digital Forensics Laboratory holds certification from British Standards Institute (BSI) to ISO 27001 for the provision of Digital Forensic Science Services.

Book your place now using our online form or contact [email protected].

DSG Digital Forensics PT Testing

I must say it’s been impressive, it’s clear that it has been established by expert and experienced practitioners.

We had good feedback from the examination staff around the complexity to questions within the workbook.

Capabilities

Accreditation Support

QMS service development, consultancy and audit

Read more

Data Management

Data management, archiving, weeding, migration including on-premises closed network / cloud storage

Read more

Digital Forensic Lab Services

Acquisition, processing and analysis of computer devices, mobile devices and cloud storage

Read more

Infrastructure Design

Operational environment, offsite-online, cloud storage and cloud computing

Read more

Triage

Timely assessment of digital devices to confirm presence of evidence and direct investigations

Read more

How digital forensics can scale up its mission-critical role to improve modern policing

Damon Ugargol
7 Aug 2024

How has CACI responded to the Forensic Science Regulator Code?

Rory Thorne
29 May 2024

What is Digital Forensics?

Damon Ugargol
13 Feb 2024

Legacy application interoperability & integration in the Police Force

Damon Ugargol
8 Jun 2023

Overcoming barriers to digital transformation in the police force

Damon Ugargol
14 May 2023

Maximising efficiency in policing through digital technology

Damon Ugargol
13 Apr 2023