NOTICE: Due to a lapse in annual appropriations, most of this website is not being updated. Learn more.

Form submissions will still be accepted but will not receive responses at this time. Sections of this site for programs using non-appropriated funds (such as NVLAP) or those that are excepted from the shutdown (such as CHIPS and NVD) will continue to be updated.

U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Forensic Science

Digital evidence

Search Publications

Search Title, Abstract, Conference, Citation, Keyword or Author
  • Published Date
Displaying 51 - 75 of 97

ITL Forensic Science Program

June 5, 2014
Author(s)
Barbara Guttman, Martin Herman, Michaela Iorga, Larry Feldman, Kim Quill
Forensic science provides the methodologies for understanding crime scenes. It is used for analyzing evidence, identifying suspects, and prosecuting and convicting criminals while exonerating innocent people. To maintain the integrity of the U.S. criminal

Guidelines on Mobile Device Forensics

May 15, 2014
Author(s)
Richard Ayers, Sam Brothers, Wayne Jansen
Mobile device forensics is the science of recovering digital evidence from a mobile device under forensically sound conditions using accepted methods. Mobile device forensics is an evolving specialty in the field of digital forensics. This guide attempts

A Model Towards Using Evidence from Security Events for Network Attack Analysis

April 27, 2014
Author(s)
Changwei Liu, Anoop Singhal, Duminda Wijesekera
Constructing an efficient and accurate model from security events to determine an attack scenario for an enterprise network is challenging. In this paper, we discuss how to use evidence obtained from security events to construct an attack scenario and

A Strategy for Testing Graphic File Carving Tools

February 19, 2014
Author(s)
James R. Lyle, Richard P. Ayers
File carving is widely used in digital investigations to extract deleted files from unallocated storage. Usually file carving is applied to file types with a recognizable structure so that unallocated space can be scanned for file components that are then

Creating Integrated Evidence Graphs for Network Forensics

October 18, 2013
Author(s)
Changwei Liu, Anoop Singhal, Duminda Wijesekera
Evidence Graphs model network intrusion evidence and their dependencies, which helps network forensics analyst collate and visualize dependencies. In particular, probabilistic evidence graph provide a way to link probabilities associated with different

Forensic Science Laboratories: Handbook for Facility Planning, Design, Construction, and Relocation.

June 25, 2013
Author(s)
James Aguilar, Tom Barnes, Joseph Browne, Yvette Burney, John Byrd, Bonnie Carver, Adam Denmark, Susan Halla, Lou Hartman, Alison Kennedy, Deborah Leben, Greg Matheson, Jim McClaren, Russell McElroy, Romeo Miranda, Kenneth Mohr, Michael Mount, Steve Sigel, Jennifer Smither, Melissa Taylor, Aliece Watts, Shannan Williams
This handbook is a resource for laboratory directors, designers, consultants, and other stakeholders involved in the construction or major renovation of forensic science laboratories. Laboratory construction and renovation projects must meet the unique

Writing Guidelines to Develop an Memorandum of Understanding for Interoperable Automated Fingerprint Identification Systems

May 14, 2013
Author(s)
Susan M. Ballou, Michael Garris, Anthony Clay, Joi Dickerson, Peter T. Higgins, Lisa Jackson, Joe Morrissey, Beth Owens, Joe Polski, Janet Hoin, Leo Norton, Melissa Taylor
This is one of a series of documents prepared by the Latent Print Automated Fingerprint Identification System (AFIS) Interoperability Working Group. The purpose of these documents is to provide guidance and a framework to those involved in the

Writing Guidelines for Requests for Proposals for Automated Fingerprint Identification Systems

April 25, 2013
Author(s)
Susan M. Ballou, Michael Garris, Anthony Clay, Joi Dickerson, Peter T. Higgins, Janet Hoin, Lisa Jackson, Mike Lesko, Joe Morrissey, Leo Norton, Beth Owens, Joe Polski, Melissa Taylor
This is one of a series of documents prepared by the Latent Print Automated Fingerprint Identification System (AFIS) Interoperability Working Group. The purpose of these documents is to provide guidance and a framework to those involved in the

The Biological Evidence Preservation Handbook: Best Practices for Evidence Handlers

April 23, 2013
Author(s)
Susan M. Ballou, Margaret C. Kline, Mark D. Stolorow, Melissa Taylor, Shannan Williams, Phylis S. Bamberger, Burney Yvette, Larry Brown, Cynthia E. Jones, Ralph Keaton, William Kiley, Karen Thiessen, Gerry LaPorte, Joseph Latta, Linda E. Ledray, Randy Nagy, Linda Schwind, Stephanie Stoiloff, Brian Ostrom
The report of the Technical Working Group on Biological Evidence Preservation offers guidance for individuals involved in the collection, examination, tracking, packaging, storing, and disposition of biological evidence. This may include crime scene

Deleted File Recovery Tool Testing Results

February 21, 2013
Author(s)
James R. Lyle
The CFTT project at the National Institute of Standards and Technology develops methodologies for testing computer forensic tools. This presentation reports on tool behaviors observed while testing digital forensics tools against a set of file deletion

Latent Interoperability Transmission Specification

February 5, 2013
Author(s)
Melissa Taylor, Will Chapman, Austin Hicklin, George Kiebuzinski, Peter Komarinski, John Mayer-Splain, Rachel Wallner
The Latent Interoperability Transmission Specification (LITS) is an application profile of the American National Standards Institute/National Institute of Standards and Technology, Information Technology Laboratory (ANSI/NIST-ITL) standard entitled

Markup Instructions for Extended Friction Ridge Features

February 5, 2013
Author(s)
Melissa Taylor, Will Chapman, Austin Hicklin, George Kiebuzinski, Peter Komarinski, John Mayer-Splain, Rachel Wallner
This document provides instructions for latent print examiners in marking friction ridge features to maximize consistency among examiners. This document builds upon the Extended Feature Set (EFS) defined in American National Standards Institute/National

Extended Feature Set Profile Specification

January 14, 2013
Author(s)
Melissa Taylor, Will Chapman, Austin Hicklin, George Kiebuzinski, John Mayer-Splain, Rachel Wallner, Peter Komarinski
This specification defines Extended Feature Set (EFS) Profiles - sets of features to be used in latent friction ridge (fingerprint, palmprint or plantar) searches of automated friction ridge identification systems (AFIS). The EFS Profiles are designed to

Latent Print Examination and Human Factors: Improving the Practice through a Systems Approach

February 17, 2012
Author(s)
Melissa Taylor, David H. Kaye, Thomas Busey, Melissa Gische, Gerry LaPorte, Colin Aitken, Susan M. Ballou, Leonard Butt, Christophe Champod, David Charlton, Itiel E. Dror, Jules Epstein, Robert J. Garrett, Max Houck, Edward J. Imwinkelried, Ralph Keaton, Glenn Langenburg, Deborah A. Leben, Alice Maceo, Kenneth F. Martin, Jennifer L. Mnookin, Cedric Neumann, Joe Polski, Maria A. Roberts, Scott A. Shappell, Lyle Shaver, Sargur N. Srihari, Hal S. Stern, David Stoney, Anjali Swienton, Mary Theofanos, Robert M. Thompson, John Vanderkolk, Maria Weir, Kasey Wertheim
Fingerprints have provided a valuable method of personal identification in forensic science and criminal investigations for more than 100 years. The examination of fingerprints left at crime scenes, generally referred to as latent prints, consists of a

Ten years of computer forensic tool testing

October 12, 2011
Author(s)
James R. Lyle, Barbara Guttman, Richard Ayers
The Computer Forensic Tool Testing (CFTT) project at the National Institute of Standards and Technology (NIST) has been active since 2000. The project develops methodologies for testing computer forensic software tools by the creation of general tool

Guide to Securing WiMAX Wireless Communications

September 30, 2010
Author(s)
Karen A. Scarfone, Cyrus Tibbs, Matt Sexton
The purpose of this document is to provide information to organizations regarding the security capabilities of wireless communications using WiMAX networks and to provide recommendations on using these capabilities. WiMAX technology is a wireless

Forensics Web Services

June 30, 2010
Author(s)
Anoop Singhal, Murat Gunestas, Duminda Wijesekera
Web services are currently a preferred way to architect and provide complex services. This complexity arises due to the composition of new services and dynamically invoking existing services. These compositions create service inter-dependencies that can be

Smart Phone Tool Specification

April 23, 2010
Author(s)
Richard Ayers
This paper defines requirements for mobile device applications capable of acquiring data from smart phones operating over a Global System for Mobile communication (GSM) network and a Code Division Multiple Access (CDMA) network, and test methods used to

Smart Phone Tool Test Assertions and Test Plan

April 23, 2010
Author(s)
Richard Ayers
This paper defines assertions and test cases for mobile device applications capable of acquiring data from mobile devices operating over a Global System for Mobile communication (GSM) and Code Division Multiple Access (CDMA) networks, used to determine

Guide to SIMfill Use and Development

February 24, 2010
Author(s)
Wayne Jansen, Aurelien M. Delaitre
SIMfill is a proof-of-concept, open source, application developed by NIST to populate identity modules with test data, as a way to assess the recovery capability of mobile forensic tools. An initial set of test data is also provided with SIMfill as a

Mobile Forensic Reference Materials: a Methodology and Reification

October 14, 2009
Author(s)
Wayne Jansen, Aurelien M. Delaitre
This report concerns the theoretical and practical issues with automatically populating mobile devices with reference test data for use as reference materials in validation of forensic tools. It describes an application and data set developed to populate
Was this page helpful?