GB/T 29362-2023Forensic sciences—Code of practice for electronic data search examination (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules for Standardization Documents" drafting.

This document replaces GB/T 29362-2012 "Regulations for Search and Inspection of Electronic Evidence Data". Compared with GB/T 29362-2012, except In addition to structural adjustments and editorial changes, the main technical changes are as follows.

--- Changed hardware requirements (see 4.1, 3.1 of the 2012 edition);

--- Changed the software requirements (see 4.2, 3.2 of the 2012 edition);

---Changed part of inspection material and sample number and photograph (see 5.1, 4.1 and 4.2 of the 2012 edition);

---Changed part of the content of "inspection" (see 5.4, 4.4 of the 2012 edition);

--- Changed the requirements for saving the checked out data (see 5.5, 4.5 of the 2012 edition);

--- Added requirements for inspection records (see Chapter 6);

--- Changed the requirements for the expression of test results (see Chapter 7, Chapter 5 of the 2012 edition);

--- Added precautions about faulty storage media (see 8.2);

--- Added precautions about encryption (see 8.3);

--- Added the precautions about the need for data reorganization (see 8.4);

--- Added the precautions about multimedia file content search (see 8.5).

1 Scope

This document specifies the equipment, operating procedures, inspection records, and expression of inspection results for electronic data search and inspection in the field of forensic science. requirements and precautions.

This document is suitable for electronic data search and inspection of storage media and preserved backup data files in the field of forensic science.

2 Normative references

The contents of the following documents constitute the essential provisions of this document through normative references in the text. Among them, dated references For documents, only the version corresponding to the date is applicable to this document; for undated reference documents, the latest version (including all amendments) is applicable to this document.

GA/T 1554 Technical Specifications for Preservation of Forensic Science Electronic Evidence Examination Materials

GA/T 1568 Forensic Science Electronic Evidence Examination Terminology

3 Terms and Definitions

The terms and definitions defined in GA/T 1568 apply to this document.

4 Instruments and equipment

5 Operation steps