Dealing with forensic software vulnerabilities: is anti-forensics a real danger?

Abstract

The idea that malicious hackers could theoretically 'fatally compromise' forensic software and evidence with a few exploits has been on practitioners' minds since the beginning of the millennium. Conferences such as the Digital Forensics Research Workshop have generated serious discussion of the technical and legal implications of such theories. According to a paper published by the Stanford Law School (2007), ''to the extent there are insufficient 'external' sources of authenticity, a proponent of forensic evidence will need to demonstrate the accuracy of the forensic software itself.''^1 Federal Rule of Evidence 901 provides that evidence may be authenticated by ''describing a process or system used to produce a result and showing that the process or system produces an accurate result.''^2