Digital Investigation Techniques: A NIST Scientific Foundation Review
James R. Lyle, Barbara Guttman, John Butler, Kelly Sauerwein, Christina Reed, Corrine Lloyd · National Institute of Standards and Technology · NISTIR 8354, 21 November 2022 · 2022
Identifier: NISTIR 8354
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
NIST's scientific foundation review of digital forensics, examining the peer-reviewed literature, academic material and practitioner guidance behind digital investigation techniques. It concludes the techniques rest on established computer science methods and are reliable when properly applied, while naming specific limits.
Who it is for, and when
This is the document to put in front of a court or opposing expert on whether digital forensics has a scientific basis, and the one to read before a Daubert or reliability challenge. It also gives an expert defensible language for the three limits NIST identifies: that evidence may not be fully discovered, that recovered deleted files can include extraneous data, and that software updates change what an artefact means over time.
What it does not cover
It is a literature and foundations review, not a procedure or validation manual: it prescribes no test method, sets no error rates for named tools, and does not tell you how to validate your own lab's workflow. Note the number carefully — this is NISTIR 8354, and it is frequently miscited.
Go to the source
Open at nist.gov (opens in a new tab)https://www.nist.gov/publications/digital-investigation-techniques-nist-scientific-foundation-review
Details
- Type
- Standard or guidance
- Written for
- AdvancedLawyers and courtsAdvanced, Lawyers and courts
- Author
- James R. Lyle, Barbara Guttman, John Butler, Kelly Sauerwein, Christina Reed, Corrine Lloyd
- Publisher
- National Institute of Standards and Technology
- Version verified
- NISTIR 8354, 21 November 2022
- Year
- 2022
- Identifier
- NISTIR 8354
- Topics
- legal-admissibility, expert-testimony, validation, research-publishing, us-federal
- Checked at source
- Standards are revised. Confirm the current revision with the publisher before citing this.
Related entries
The decision holding that the Federal Rules of Evidence, not Frye's general-acceptance test, govern expert scientific testimony, and that the trial judge acts as a gatekeeper for reliability and fit. It offers a non-exclusive list of considerations: testability, peer review and publication, known or potential error rate, standards controlling the technique's operation, and general acceptance.
The federal admissibility rule for expert testimony. The 2023 amendment moved the burden into the rule text — the proponent must demonstrate to the court that it is more likely than not that each of the four requirements is met — and rewrote subsection (d) so that the opinion must reflect a reliable application of the principles and methods to the facts of the case.
An illustration of sufficient authentication: "Evidence describing a process or system and showing that it produces an accurate result." It is the route by which the output of software, an acquisition tool, or an automated system is authenticated through testimony about the tool rather than about the document.
The decision extending the Daubert gatekeeping obligation to all expert testimony under Rule 702, including technical and other specialized knowledge, and holding that the Daubert considerations are flexible rather than mandatory, with the trial court's choices reviewed for abuse of discretion.
The judiciary's own reference work on scientific and technical evidence, produced jointly by the Federal Judicial Center and the National Academies, made up of reference guides written by scientists and judges on individual fields plus chapters on the judge's gatekeeping role. The fourth edition rewrites every guide carried over from 2011 and adds new guides on eyewitness identification, computer science, and artificial intelligence.