CWA 17865:2022

Requirements and Guidelines for a complete end-to-end mobile forensic investigation chain

Scope

This CEN Workshop Agreement (CWA) focuses on the Personnel, Tools, Processes and Legal and Ethical framework specific for mobile forensics and including the following topics:
a) Competencies;
b) device seizure;
c) data preservation;
d) data acquisition;
e) data examination and analysis;
f) documentation of all investigation steps;
g) reporting;
h) evaluation and sharing of information with other LEAs; and
i) legal and ethical considerations.
In addition to the process-related issues, the document covers requirements for new curriculum for training of LEA officers, security practitioners and criminal prosecution experts to ensure that the evidence from mobile devices is court-approved across national borders.
It is recognised that national laws and good practices applied at LEAs vary not only between different European countries but also within these countries. This CWA offers a collection of building blocks covering different aspects of mobile forensics allowing for adjustments based on national laws and regulations as well as internal rules and codes of conduct. It allows LEAs from different countries to accommodate their available technical solutions, at the same time offering a standardised collection of procedures and requirements.
It should be explicitly stated that it is not possible to cover all the possible related topics for mobile forensics. Detailed subject matters and specialisms such as Cloud Forensics, Cell Site Analysis, Interception of Communications are excluded. Similarly, the rules and regulations about chain of custody in general, plus guidance for transmission of evidence across national boundaries are excluded from this standards document.