Information Assurance Applied to Authentication of Digital Evidence

• NCJ Number: 218697
• Author(s): Thomas E. Duerr; Nicholas D. Beser; Gregory P. Staisiunas
• Date Published: October 2004
• Length: 11 pages
• Sale Source: US Dept of Justice Federal Bureau of Investigation
• Publication Format: Document (Online)
• Publication Type: Report (Technical)
• Language: English
• Country: United States of America
• Note: From Forensic Science Communications, N 4, V 6, October 2004; downloaded June 5, 2007.

Annotation

This paper explores the potential for applying information assurance to the authentication of digital evidence in general and discusses a prototype application to digital video in particular.

Abstract

Compared to analog evidence, digital evidence is potentially more susceptible to postcollection alteration and to defense attorneys' accusations that such alterations have occurred. In countering such accusations, digital evidence is amenable to the information-assurance methods that have been developed for Internet applications and electronic commerce. The primary security services relevant to digital information and its processing systems are access control, confidentiality, integrity, availability, and nonrepudiation. Access control consists of measures that prevent unauthorized user access to networked hardware, software, and data. The confidentiality security service involves the protection of data from unauthorized disclosure. The integrity security service includes protection of data from modifications, detecting modifications, and recording modifications. Availability is concerned with ensuring that network data and services are provided to users with a specified quality of service when the network is subject to normal loads, failures, and outright attacks. Nonrepudiation services provide proofs that participating parties were involved in a communication (for example, an electronic commerce exchange). The objective is to make it impossible for a person to support a denial of having had access to information or information-processing resources or engaging in specific activities regarding the use of information and resources. The information-assurance service most clearly relevant to the authentication of digital evidence is integrity, i.e., the protection of data from modifications, detection of modifications, and recording modifications. The nonrepudiation service could be applied to bolster chain-of-custody recordkeeping. This paper concludes with the description of an information-assurance system that addresses access control, integrity, and nonrepudiation for a digital video evidence system. 6 references and appended supplementary information