GA/T 1569-2019Forensic sciences - Specifications for building laboratories for electronic evidence examination (English PDF)

Foreword

This standard was drafted in accordance with the rules given in GB/T 1.1-2009.

Please note that some elements of this document may involve patents. The issuer of this document is not responsible for identifying these patents.

This standard was proposed by the National Criminal Technical Standardization Technical Committee Electronic Material Evidence Inspection Sub-Technical Committee (SAC/TC179/SC7) Out.

This standard is under the jurisdiction of the National Criminal Technology Standardization Technical Committee (SAC/TC179).

This standard was drafted. Material Evidence Identification Center of the Ministry of Public Security, Procuratorate Technical Information Research Center of the Supreme People's Procuratorate, Heilongjiang Public Security Department, Chongqing Public Security Bureau, Tianjin Public Security Bureau.

1 Scope

This standard specifies the specifications for the construction of electronic physical evidence inspection laboratories.

This standard applies to the construction of electronic physical evidence testing laboratories in the field of forensic science.

2 Reference standards

The following documents are essential for the application of this document. For dated references, only the dated version applies to this document.

For undated references, the latest version (including all amendments) applies to this document.

GB 50015-2010 design code for water supply and drainage of buildings GB 50016-2014 fire protection code for building design GB 50019-2015 design code for heating, ventilation and air conditioning GB 50057-2016 building lightning protection design code GB 50073-2013 clean plant design code GB 50116-2013 design code for automatic fire alarm system GB 50174-2016 Design Specification for Electronic Information System Room GB 50222-2015 code for fire protection design of building interior decoration GB 50311-2015 Engineering Design Specification for Integrated Cabling System GB 50343-2015 Technical Specifications for Lightning Protection of Building Electronic Information Systems

3 Laboratory classification

Electronic physical evidence laboratory is divided into three levels.

a) Level I Electronic Material Evidence Laboratory;

b) secondary electronic physical evidence laboratory;

c) Level 3 Electronic Material Evidence Laboratory.

4 Business Scope

5 Data search must-have

6 Document consistency check

7 Software function test must be optional

8 Software Consistency Check Mandatory Optional

GA/T ××××-××××

9 Time attribute inspection

10 Necessary Essentials for Online Record Inspection

11 Email Inspection Mandatory Mandatory Optional

12 Essentials for Instant Messaging

13 Necessary and optional for log inspection

14 Database Inspection Mandatory Optional

15 Password cracking required optional

16 Necessary Essentials for Mobile Phone Inspection

17 Necessary Essentials for Inspection of Video Surveillance Equipment

18 "Pseudo base station" inspection must be optional

19 Necessary optional for inspection of damaged storage media

20 Required Data Wipe

21 Necessary and optional for mobile phone information correlation analysis

22 Network Information Association Analysis Mandatory Optional

5 Lab area settings

5.1 Business acceptance/pre-inspection area it is used for commissioning and accepting inspections of cases (events), receiving clients, including acceptance, registration, unique numbering, and taking pictures of inspection materials.

5.2 Storage media repair area it is used to recover the physically damaged storage medium through special technical means or open the disk in a dust-free environment to extract data.

5.3 Data acquisition area it is used to make a bit-to-bit security backup of inspection materials, or to obtain them as evidence files.

5.4 Comprehensive inspection area Used for comprehensive inspection of electronic data in acquired electronic equipment (storage media) such as computers, surveillance video recorders, including data Analysis, search, recovery, etc.

5.5 Mobile terminal inspection area Used to test mobile terminals such as mobile phones.

5.6 Data decryption area Decryption inspection for electronic equipment, data files, etc.

5.7 Material evidence storage area it is used to store electronic equipment, storage media and backup data generated during the inspection process.

5.8 Central computer room area Used to store servers, network devices, and storage devices.

5.9 Clean room

It is used to inspect the inspection materials whose inspection environment should meet the relevant requirements of cleanliness level 3 in GB 50073-2013.

5.10 Shielded Room

It is used to inspect the inspection materials that should shield the wireless signal in the inspection environment.

6 Requirements for construction facilities

6.1 Laboratory area

See Table 2 for the area requirements of laboratories at all levels.

GA/T ××××-××××

Table 2 Areas of laboratories (unit. m2)

Zone division

Laboratory grade

Level 1 Level 2 Level 3 Case acceptance/pre-inspection area >=20 >=15 >=10 Storage media repair area >=10 Optional Data acquisition area >=30 >=15 optional Comprehensive inspection area >=100 >=70 >=40 Mobile terminal inspection area >=30 >=20 >=10 Data decryption area >=20 optional Material evidence storage area >=50 >=20 >=10 Central computer room area >=40 >=30 optional Clean room optional Shielded room optional Total area >=300 >=170 >=70

6.2 Location selection

6.2.1 The natural environment is clean.

6.2.2 Keep away from places that produce dust, oil fume, harmful gases, and produce or store corrosive, flammable and explosive materials.

6.2.3 Keep away from flood and fire hazard areas.

6.2.4 Keep away from strong vibration sources and strong noise sources.

6.2.5 Avoid strong electromagnetic field interference.

6.2.6 Have stable and reliable power supply.

6.3 Building structure

6.3.1 Lighting requirements should have good natural lighting or indoor lighting.

6.3.2 Laboratory height the clear height of the laboratory should not be less than 2.5m.

6.3.3 Exhaust air duct when the exhaust air duct is set, it should be installed in a more hidden place or a corner of the wall.

6.3.4 Water equipment when water equipment is installed in the main room, measures should be taken to prevent water overflow. Water supply and drainage pipelines shall take measures to prevent leakage and dew condensation.

And should comply with the provisions in GB 50015-2010.

6.3.5 Network

6.3.5.1 Three networks of local area network, Internet and private network should be laid in the laboratory, and the three networks should be physically isolated.

6.3.5.2 The design of the network cabling system shall meet the requirements of GB 50311-2015.

6.3.5.3 The network transmission medium shall use optical cables or twisted-pair cables of category six and above, and the grades of each component of the transmission medium shall be maintained at one level.

Consistent, and should adopt a redundant configuration.

6.3.6 Fire safety

6.3.6.1 The fire resistance rating shall not be lower than the second level specified in GB 50016-2014.

6.3.6.2 An automatic fire alarm system shall be provided. The automatic fire alarm system shall comply with the relevant regulations of GB 50116-2013.

6.3.6.3 The necessary fire protection measures shall be taken in accordance with the relevant regulations of GB 50016-2014.

6.3.7 Lightning protection and grounding GA/T ××××-×××× Lightning protection measures shall be taken, shielded cables shall be used for signal lines, lightning protection devices and cable shields shall be grounded, and the grounding resistance shall comply with GB 50174-2016 related regulations.

The lightning protection and grounding design of the laboratory should meet the requirements of personal safety and normal operation of electronic equipment, and meet the requirements of GB 50057-2016 and Relevant regulations of GB 50343-2015.

6.4 Building decoration

6.4.1 Envelope materials the materials of the envelope structure should meet the requirements of heat preservation, heat insulation, fire prevention, moisture resistance, and low dust production.

6.4.2 Interior decoration materials Materials for laboratory decoration should be selected for good air tightness, dust-free, easy to clean, meet environmental protection requirements, under the effect of temperature and humidity changes for materials with small deformation and surface static dissipative properties, their combustion performance should meet the relevant regulations of GB 50222-2015.

6.4.3 Surface gap

Doors, windows, walls, ceilings, ground structures and construction gaps should be sealed.

6.4.4 Walls and ceilings the surface should be flat, smooth, moisture-proof, dust-free, avoid glare, and reduce uneven surfaces.

The ceiling, siding (including core material) and partitions shall be non-combustible.

6.4.5 Ground

An anti-static floor shall be laid. The floor shall be provided with static discharge measures and grounding structure, and shall have fire resistance, environmental protection, pollution resistance and wear resistance. Prevent the surface resistance or volume resistance of the electrostatic floor should meet the relevant regulations of GB 50174-2016.

6.4.6 Door

Moisture-proof and fire-resistant materials should be used, with safety locks and no thresholds.

6.4.7 window

Aluminium or plastic steel mobile windows with screens should be provided. Hollow glass windows with good thermal insulation properties should be used. Curtains should be hung on the windows.

6.4.8 Ceiling

Structures or brackets installed on the top for installing surveillance cameras or lighting fixtures shall be moisture-proof and flame-retardant materials.

6.4.9 Inspection material sample cabinet the laboratory shall be equipped with anti-magnetic and anti-static test materials and sample storage cabinets.

6.5 Environmental requirements

6.5.1 Temperature and humidity the laboratory shall be installed with air conditioners. The installation of air conditioners shall comply with the relevant regulations of GB 50019-2015 and GB 50016-2014.

The temperature and humidity in the laboratory shall meet the Class C requirements of the main room in Appendix A of GB 50174-2016.

6.5.2 Radio interference Radio interference field strength in the laboratory. At the frequency of 0.15MHz-1000MHz, radio interference field strength in the main room and auxiliary area it should not be greater than 126dB.

6.5.3 Magnetic Field the magnetic field interference environmental field strength in the laboratory area should not be greater than 800A/m.

6.5.4 Vibration

When the electronic equipment is stopped, the vertical and horizontal vibration acceleration value of the floor surface should not be greater than 500mm/s2.

6.5.5 Electrostatic potential the electrostatic potential of the insulator in the laboratory area should not be greater than 1kV.

6.5.6 Noise

When the electronic equipment is stopped, the noise value in the laboratory should be less than 65dB (A).

6.6 Electrical requirements

6.6.1 Special distribution box (cabinet) shall be used.

6.6.2 Class I lamps are used in the laboratory. The power supply circuit of the lamp should have a protective wire, and the protective wire should be electrically connected to the metal lamp shell.

GA/T ××××-××××

6.6.3 The illuminance standard value of general lighting in the laboratory should meet the requirements of the test area standard in GB 50174-2016.

6.6.4 The uninterruptible power supply system of power equipment and electronic information equipment in the laboratory shall be distributed by different circuits.

6.6.5 The inspection equipment shall be equipped with an uninterruptible power supply.

6.6.6 The power cords and power sockets shall meet the load requirements of the laboratory equipment, with some redundancy.

6.7 Cleanliness requirements the clean room shall meet the requirements of the relevant cleanliness level 3 regulations in GB 50073-2013.

7 Device configuration See Table 3 for configuration requirements of laboratory equipment at all levels.

Table 3 Configuration table of laboratory equipment

Equipment name

Measure

unit

Minimum laboratory equipment configuration Service life Level 1 Level 2 Level 3

1 On-site evidence collection investigation equipment set for electronic physical evidence 3 2 2 3-5 years

2 Set of online extraction inspection equipment 2 1 1 3-5 years

3 Smart terminal data field extraction equipment set 2 1 1 3-5 years 4 hard disk duplicator (clone) 1 1 1 3-5 years

5 Electronic evidence read-only device sets 6 4 2 3-5 years

6 Various hard drive adapter sockets 1 1 1 3-5 years

7 Various interface data cable sets 1 1 1 3-5 years

8 Multi-function read-only card reader cover 2 2 2 3-5 years

9 Digital Camera Station 1 1 1 3-5 years

10 Digital Camera Station 1 1 1 3-5 years

11 Multifunctional physical remake instrument table 1 1 Optional 3-5 years

12 Screen recording software suite 1 1 1 3-5 years

13 Special hard disk forensics equipment set 1 1 Optional 3-5 years

14 Flash memory repair equipment set 1 Optional 3-5 years

15 CD repair equipment set 1 Optional Optional 3-5 years

16 Electronic Data Recovery System 1 1 1 3-5 years

17 Dust-free workbench cover 1 Optional 5-10 years

18 Opening machine 1 Optional Optional 3-5 years

19 Hard disk removal tool set 1 Optional Optional 3-5 years

20 Electronic physical evidence inspection integrated workstation set 4 2 1 3-5 years

21 Password Cracking System Set 1 Optional Optional 3-5 years

22 Video forensics and recovery equipment sets 1 1 1 3-5 years 23 "Pseudo base station" inspection equipment set 1 Optional Optional 3-5 years

24 Electronic physical evidence inspection integrated workstation set 4 2 1 3-5 years

25 Electronic data inspection and analysis software suite 1 1 1 3-5 years

26 Electronic data distributed analysis system set 1 1 Optional 3-5 years

27 Various types of genuine operating system software packages 1 1 1 3-5 years

28 Mobile Forensic Analysis System Set 3 2 1 3-5 years

GA/T ××××-××××

Table 3 (continued)

29 Mobile phone chip extraction equipment set 1 1 optional 3-5 years

30 Mobile password cracking software suite 1 1 1 3-5 years

31 Simulation software set 2 1 Optional 3-5 years

32 Visual Association Analysis System 2 1 1 3-5 years

33 Electronic data analysis system set 1 optional 5-10 years

34 Electronic data destruction machine 1 1 Optional 3-5 years

35 CD data destruction machine 1 1 Optional 3-5 years

36 Shielding boxes 2 1 1 5-10 years

37 CD burner station 2 2 optional 3-5 years

38 Scanner table 1 1 1 3-5 years

39 Color printing copier table 1 1 1 3-5 years

40 Electronic data analysis server station 1 1 Optional 3-5 years

41 Storage array table 1 1 optional 3-5 years

42 Anti-magnetic anti-static cabinets 2 1 1 5-10 years

43 Electronic physical evidence safes 3 2 1 5-10 years

44 UPS uninterruptible power supply set 1 1 1 3-5 years

45 Laboratory Quality Management System Set 1 1 1 3-5 years

46 Mobile phone sample library options optional options optional 3-5 years

47 Hard disk sample library set optional 3-5 years

48 Electronic Material Evidence Mobile Lab Kit Option Option Option 5-10 Years