Is Digital Forensics too dependent on point and click tools?

Should the Federal Government regulate Digital Forensics?

Does Digital Forensics fall under the umbrella of Technology or Science?

Digital Forensic Certification Bodies Should be Accredited by the Forensic Specialities Accreditation Board (FSAB)

Follow by Email

Friday, March 25, 2011

Does Digital Forensics Suffer from Physics Envy?

For over a decade we have been fighting to have digitial forensics recognized as a science. Committees have been struck, organizations created and a great deal of blood sweat and tears has gone into having the American Academy of Forensic Sciences recognize us as a new section - Digital and Multimedia Sciences. We have also written numerous papers, conducted workshops and heavily marketed for the covetted recognition as a "SCIENCE".

What if we got it wrong? Can we really make a solid case for digital forensics being a science? The goal of science is the pursuit of knowledge. This is accomplished by using the scientific method or process. Theories are derived, hypotheses created and experiments designed to test these educated guesses. The interpretation of the findings are supposed to be value free and the results reproducable.

The goal of technology on the other hand is to meet the needs of some applied problem, focusing on some short term solution. The major processes include design, implementation, and testing. The deteremination of the success or failure is value ladden and reproducability of findings not necessarily criticial.

If we limit our discussion to the current state of digital forensics which category do we more easily fit into? It is really a no brainer - we are a technology that may at some point in the future move to a science, but we are not their yet.

The next important issue to contemplate is whether we actually have to become a science. Can we still serve our purpose and mandate (as well as the courts') by remaining a technology? Maybe we just have a case of Physics envy.


  1. Digital forensics is obviously a technology and considered by many to also be a science, however the field is not currently using scientific methods. It uses technologies that have not been scientifically tested for reliability, thus not holding up to its name.

    Since Digital forensics is being recognized as a science, then DF evidence in court should be considered scientific and held to the Daubert standards.

    If we do not start proving tool reliability through publication and peer review, then we will turn into a junk science (or remain a junk science depending on how you look at it).

  2. If we are a technology I feel that it is important to maintain a "scientific" approach to how we operate. We need to maintain the step by step proofs and tests that give our field (our technology) validity.

    This would also help to keep us from becoming a pseudo-profession and allow us to have the credibility of a science without fitting necessarily into the field of science.

    Based upon the definitions in the blog, I would have to agree that we are a technology.