APPENDIX C-2
Questionnaire for Review of Conformity with
Quality Standards for Digital Forensics
June 18, 2019
1
PURPOSE. This appendix is used to aid in the assessment of an organization’s conformity with the Quality Standards for Digital Forensics (QSDF), dated June
18, 2019, and it is used during Council of the Inspectors General on Integrity and Efficiency (CIGIE) qualitative assessment reviews of investigative operations.
The purpose of this appendix is to guide the review and assist in making a determination that an organization has adequate policies and procedures to ensure
digital forensics can be properly employed to support investigations performed by the organization. This appendix does not establish or define any standards but
is simply a checklist referencing the standards in the QSDF. If the organization conducting the peer review does not have in-house personnel with digital forensic
experience to conduct the review of an organization that conducts its own digital forensics work, it must seek assistance from another CIGIE organization. While
all organizations should immediately begin implementing the requirements in the 2019 QSDF, organizations are not required to meet the new requirements
(identified with an asterisk below) until October 1, 2020. This document supersedes Appendix C-2, Questionnaire for Review of Conformity with Quality
Standards for Digital Forensics, dated November 19, 2013.
Review Step
N/A
PHASE 1
Policy/
Procedure
PHASE 2
Consistent
Practice
Reviewed
Agency
Policy/Manual
Reference
QSDF
Guideline
Reference
Comments
Yes
Yes
No
A. MANAGEMENT STANDARDS Management standards apply to the organizational environment in which digital forensics are performed.
1. Does the organization have written policies and procedures
to ensure digital forensics can be used to support its
investigations, when appropriate?
QSDF, Mgmt
Stds, Section A
2. Does the organization have policy on how it handles
situations where the capability to acquire or analyze ESI is
needed (whether performed internally or by an external
entity)?
QSDF, Mgmt
Stds, Section A
3. Do examiners ensure they have the legal authority to search
through the digital data they are examining?
QSDF, Mgmt
Stds, Para A.2
4. Do examiners consult with the prosecutor or the
organization’s counsel to resolve any questions about the
authority to conduct a forensic examination?
QSDF, Mgmt
Stds, Para A.2
5. Is ESI handled and stored in a manner that precludes the
inadvertent alteration or destruction of evidence by human
interaction or environmental conditions, and is the chain of
custody maintained?
QSDF, Mgmt
Stds, Para A.3
APPENDIX C-2
Questionnaire for Review of Conformity with
Quality Standards for Digital Forensics
June 18, 2019
2
Review Step
N/A
PHASE 1
Policy/
Procedure
PHASE 2
Consistent
Practice
Reviewed
Agency
Policy/Manual
Reference
QSDF
Guideline
Reference
Comments
Yes
Yes
No
6. Is a digital forensic examination report written when an
examiner provides expert opinion, interprets digital data,
draws conclusions, or uses specialized digital forensic
knowledge or techniques to recover/reconstruct info?*
QSDF, Mgmt
Stds, Para A.4
7. Do digital forensic examination reports or summaries of
extractions or other activities, together with associated
documentation in the official file, include the following:
QSDF, Mgmt
Stds, Para A.4
a. Identity of reporting organization.
QSDF, Mgmt
Stds, Para A.4
b. Case identifier or submission number.
QSDF, Mgmt
Stds, Para A.4
c. Identity of the submitter.
QSDF, Mgmt
Stds, Para A.4
d. Relevant dates, including report or summary date.
QSDF, Mgmt
Stds, Para A.4
e. Descriptive list of the evidence examined.
QSDF, Mgmt
Stds, Para A.4
f. Examination or other actions requested.
QSDF, Mgmt
Stds, Para A.4
g. Description of the examination or other actions, as
appropriate.
QSDF, Mgmt
Stds, Para A.4
h. Name and signature (handwritten or digital) of the
examiner.
QSDF, Mgmt
Stds, Para A.4
i. Results, conclusions, and derived items, as appropriate.
QSDF, Mgmt
Stds, Para A.4
j. Contemporaneous work notes (or detailed automated
logs).*
QSDF, Mgmt
Stds, Para A.4
APPENDIX C-2
Questionnaire for Review of Conformity with
Quality Standards for Digital Forensics
June 18, 2019
3
Review Step
N/A
PHASE 1
Policy/
Procedure
PHASE 2
Consistent
Practice
Reviewed
Agency
Policy/Manual
Reference
QSDF
Guideline
Reference
Comments
Yes
Yes
No
8. If the organization uses external forensic support, does it
evaluate that entity’s ability to conduct the work consistent
with the QSDF?*
QSDF, Mgmd
Stds, Para A.5
9. Does the organization have a quality management system to
govern digital forensic methodologies and work products?
QSDF, Mgmt
Stds, Section B
and Para B.1
10. Are all forensic examinations administratively reviewed for
consistency with organizational policy?
QSDF, Mgmt
Stds, Para B.2
11. Are at least 50%* (100% in 2024) of final digital forensic
examination reports technically reviewed by another
qualified examiner (peer reviewed) before the reports are
published?
QSDF, Mgmt
Stds, Para B.3
12. To the extent possible, does the organization ensure the
tools they use to acquire ESI are validated to operate as
intended and accurately acquire data?
QSDF, Mgmt
Stds, Para B.4
13. Does the organization have a policy concerning the
verification of significant findings when validated or generally
accepted examination tools are not used?*
QSDF, Mgmt
Stds, Para B.5
14. Does the organization centrally control policies and other
documents used for digital forensics to prevent the
unintended use of obsolete versions?*
QSDF, Mgmt
Stds, Para B.6
15. Does the organization monitor all expert testimony given by
its employees in criminal proceedings that supports digital
forensics work performed by the employees.*
QSDF, Mgmt
Stds, Para B.7
16. Does the organization document deficiencies and failures
potentially impacting the quality of digital forensic products
and the corrective actions taken?*
QSDF, Mgmt
Stds, Para B.8
17. Does the organization review its quality management system
annually* to ensure the system is meeting the quality needs
of the organization?
QSDF, Mgmt
Stds, Para B.9
APPENDIX C-2
Questionnaire for Review of Conformity with
Quality Standards for Digital Forensics
June 18, 2019
4
Review Step
N/A
PHASE 1
Policy/
Procedure
PHASE 2
Consistent
Practice
Reviewed
Agency
Policy/Manual
Reference
QSDF
Guideline
Reference
Comments
Yes
Yes
No
B. PERSONNEL STANDARDS Personnel standards apply to all personnel performing digital forensic tasks and address qualifications and proficiency.
18. Do personnel assigned to perform digital forensic activities
possess technical competency for the tasks they are
assigned.
QSDF, Personnel
Stds, Section A
19. Does the organization screen digital forensic applicants to
ensure they possess the highest standards of conduct and
ethics, including unimpeachable honesty and integrity?
QSDF, Personnel
Stds, Para A.4
20. Does the organization have a policy that requires persons
performing digital forensics to report any arrest, conviction,
or other potential misconduct issue that would jeopardize
their performance of duties?
QSDF, Personnel
Stds, Para A.4
21. Do all personnel performing digital forensics attend a formal
training program for the tasks they perform?
QSDF, Personnel
Stds, Section A.7
22. Do personnel performing digital forensics demonstrate they
are competent to perform those functions before performing
independent work?
QSDF, Personnel
Stds, A.8
23. Do forensic examiners receive a minimum of 120* hours of
training during every 3-year period?
QSDF, Personnel
Stds, Para B.2
24. Do forensic specialists receive a minimum of 60* hours of
training during every 3-year period?
QSDF, Personnel
Stds, Para B.2
25. Do forensic personnel pass a practical proficiency test at
least once every 3 years?
QSDF, Personnel
Stds, Para B.3
*These are new or updated requirements in the 2019 QSDF, and organizations are not required to be fully compliant prior to
October 1, 2020. Appropriate policies must be in place by October 1, 2020, and all work performed after this date must comply with
the new standards.