GB/T 29360-2023Forensic sciences—Code of practice for electronic data recovery examination (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules for Standardization Documents" drafting.

This document replaces GB/T 29360-2012 "Inspection Procedures for Data Recovery of Electronic Evidence". Compared with GB/T 29360-2012, except In addition to structural adjustments and editorial changes, the main technical changes are as follows.

--- Changed the scope of application of the standard (see Chapter 1, Chapter 1 of the 2012 edition);

--- Increased the terms and definitions of file repair (see 3.1);

--- Increased the terms and definitions of file characteristics (see 3.2);

--- Changed hardware requirements (see 4.1, 4.1 of the 2012 edition);

--- Changed the software requirements (see 4.2, 4.2 of the 2012 edition);

---Changed part of inspection material and sample number and photograph (see 5.1, 5.1 and 5.2 of the 2012 edition);

---Changed part of the "inspection" (see 5.4, 5.4 of the 2012 edition);

--- Changed the requirements for saving the checked out data (see 5.5, 5.5 of the 2012 edition);

--- Added requirements for inspection records (see Chapter 6);

--- Changed the requirements for the expression of test results (see Chapter 7, Chapter 6 of the 2012 edition);

--- Added precautions about faulty storage media (see 8.2);

--- Added precautions about encryption (see 8.3);

--- Added a note about the need for data reorganization (see 8.4).

1 Scope

This document specifies the equipment, operating procedures, inspection records, and presentation requirements for electronic data recovery inspection in the field of forensic science. requirements and precautions.

This document is applicable to the electronic data recovery inspection of storage media and preserved backup data files in the field of forensic science.

2 Normative references

The contents of the following documents constitute the essential provisions of this document through normative references in the text. Among them, dated references For documents, only the version corresponding to the date is applicable to this document; for undated reference documents, the latest version (including all amendments) is applicable to this document.

GB/T 36450.5 Information Technology Storage Management Part 5: File System

GA/T 1554 Technical Specifications for Preservation of Forensic Science Electronic Evidence Examination Materials

GA/T 1568 Forensic Science Electronic Evidence Examination Terminology

3 Terms and Definitions

GB/T 36450.5, GA/T 1568 and the following terms and definitions apply to this document.

4 Instruments and equipment