Digital and Multimedia Evidence Subcommittee

Discipline Overview:

Digital and Multimedia Evidence (DME) examination is the process of extracting, examining, and interpreting information of interest stored in a digital format. This includes, but is not limited to, images, videos, audio recordings, file metadata, 3D point cloud data, mobile devices, hard drives, servers, cloud storage, social media, vehicle infotainment systems, internet-of-things devices, and other digitally stored sources of data.  This type of analysis involves various techniques including data preservation, extraction, authentication, clarification, pattern recognition, data interpretation, and content verification.

Digital and Multimedia Evidence Subcommittee Chair

Kimberly Meline, Va. USA

DME analysis is used in a variety of forensic disciplines to assist the legal community and trier of fact in various and significant ways:

• Ensuring the digital data was collected according to industry best practices.
• Identifying key evidence and events from available digital data, such as surveillance footage, mobile devices and social media posts.
• Analyzing and clarifying the data to better understand the events captured in a digital format.
• Authenticating evidence, including the detection of image tampering or AI- generated multimedia.
• Conducting research and developing forensic best practices in the DME field.
• Providing expert and detailed testimony in a court of law to assist the trier of fact in understanding complex technical considerations, in order to assess the appropriate weight to any analysis results and/or conclusions.  

Due to the plethora of applications within the field, the DME examiner must be trained in a wide variety of devices and storage applications. This technology is constantly evolving, and thus the DME examiner must keep appraised of the changing digital landscape through ongoing training and research.

The results of a DME examination may assist investigators and the courts in identifying or providing a better understanding of events of interest, isolating and identifying potential suspects, actions captured in the data, locations where the event occurred, and may refute or corroborate other evidence and testimony.

Qualifications:

Most forensic examiners hold at least a bachelor’s degree in a relevant scientific or technical field, such as forensic science, computer science or engineering, or have extensive on-the-job training. On-the-job training and mentorship (after appropriate baseline training) refines and improves the ability of the examiner to conduct preservation, collection, processing and interpretation of digital data and evidence. This process also builds and bolsters the examiners’ credentials and ability to process more complicated and advanced forensic examinations. This experience improves the examiner’s ability to convey technical information and DME topics to lay individuals at various levels.  

Certification:

Certification is one mechanism to demonstrate competency and proficiency in a specific DME specialty as measured by relevant scientific communities. The certification process is regulated and controlled by written policies, procedures, and testing by a board of trained, vetted and competent DME scientists. There are many DME certification options, including:

Standards:

• Standards for Digital and Multimedia Examinations are written by:
• NIST Digital/Multimedia Scientific Area Committee
• The Scientific Working Group on Digital Evidence (SWGDE)
• The American Society for Testing and Materials (ASTM)
• ISO 17025, 17024 and other international organizations.