This policy provides a framework to use when receiving, assigning, and prioritizing work. Because of the volume of requests handled by the laboratory each year, cases must constantly be reviewed and re-prioritized based upon the information available at the time of decision making. This policy was written with ISO 17025 in mind.

This policy outlines the corrective action procedures to be followed if discrepancies are reported either through testing or in actual casework. The goal of the correction action plan is to review the discrepancy, determine the event(s) that led to the discrepancy, and implement appropriate corrective measures. This customizable policy is written with ISO 17025 in mind.

Because of the very nature of investigations involving technology and the ever-changing software, hardware, and analysis equipment, there may be time when it is appropriate for a forensic analyst to deviate from written policies or procedures. Certain aspects of an analysis may also dictate the need to deviate from policies and procedures, such as exigent circumstances. This policy, written in accordance with ISO 17025, provides a forensic lab with a customizable Word document.

The validation of forensic hardware devices such as writeblockers is required to ensure the devices work as advertised and can be trusted to perform appropriately. Prior to any forensic hardware being placed in service, the forensic lab should conduct a validation of that device. This policy, written in accordance with ISO 17025, is customizable for a forensic lab to adopt.

Evidence handling and storage is one of the higher-risk areas for a digital forensics lab. Allegations of evidence mishandling are often brought up during legal hearings and trials, making it critical that labs have strong policies and abide by those policies. This policy details the proper handling and storage of property and evidence when in the custody of laboratory staff and is written with ISO 17025 in mind.

Digital forensic laboratories must be secured with strict access control requirements. This customizable Word document is a policy for digital forensic labs to define requirements for physical security and access to the forensic laboratory and written in accordance with ISO 17025 standards.

Performing a competent and detailed digital forensic examination is one aspect of an analyst's job. Writing a well-written, understandable, and professional digital forensic report is yet another. This report writing policy outlines how forensic reports should be handled and is written in accordance with ISO 17025 standards.

This customizable Word document is a policy for digital forensic labs to outline how digital evidence is to be stored and retained by the digital forensics laboratory. The proper handling, naming, storage, and retention of digital evidence is something every forensic lab should have a policy on. This policy was written with ISO 17025 in mind.

Digital forensic laboratories must ensure their analysts stay current on technological trends, new operating systems, and devices in order to provide services. This policy describes training program management for a digital forensic lab and is written in accordance with ISO 17025 standards.

Digital forensic labs should require anyone submitting evidence for analysis to provide the lab with documentation before the exam even begins. Part of the documentation should be a services request form that provides the lab and forensic analyst with detailed information about why a forensic exam is being requested, who the involved parties are, and what type of evidence is being sought. This service request form was designed with ISO 17025 in mind and has been used in labs across the U.S.

Tracking the exact location and movement of all digital evidence is a foundational requirement of any laboratory quality system. This form allows an easy way to track the movement of evidence while forensic analysts conduct forensic imaging, physical examinations, and analysis of the digital evidence. Written with ISO 17025 in mind, this form should be part of any digital forensic lab.

Customizable Word form to track the status of cases submitted to a digital forensic laboratory.

When digital evidence contains contraband or other illegal material and that evidence needs to be released to investigators or other parties, it is important for the forensic lab to place the receiving party on notice that the digital devices contains this material. By having the receiving party sign this form, it places them on notice of the contents of the device to ensure it is not inadvertently released or improperly stored.

When devices are submitted to a forensic lab and are ready to be returned or released, they may contain data that should be destroyed and not released outside of the forensic lab. In these circumstances, this document can be used to obtain consent to forensic delete certain files or sanitize an entire device, making that data irrecoverable.

When receiving consent to search a digital device or other electronic evidence, a standard consent to search form is not practical and can lead to legal challenges. This form is specifically designed for electronic evidence and has been used by law enforcement agencies across the U.S. and withstood legal challenges. Always check with your own counsel and/or prosecutor for any local changes necessary.

A digital forensic lab should have a policy that outlines when forensic hardware and software will be validated to ensure they perform as advertised. This template is an example of how forensic software (in this case, FKT Imager) can be validated to ensure it operates within the parameters expected. This document has been accepted by labs accredited by ASCLD/LAB.

Evidence arrives at a digital forensic lab in several ways - whether from a customer physically dropping it off, a client sending evidence via a courier, or downloaded from the Internet. All incoming evidence must be accounted for and this form provides a proven way to establish the chain of custody and when evidence was received by the lab. This form has been used in trials, in ASCLD/LAB ISO 17025 accredited laboratories, and many other organizations.

Performing a thorough digital forensic examination is great, but unless a well-written, competent, easy to understand forensic report goes along with the great examination, it may not be that helpful to the recipient. Our report template has been used in organizations ranging from federal law enforcement and national security organizations to private companies and internal investigation cases. Written with ISO 17025 in mind, this report template should be part of any serious digital forensic lab.

There are always things to note during a forensic exam - the size of a hard drive, serial number of a computer, etc. This document provides a standard format to capture analyst notes. Written with ISO 17025 in mind, these notes comply with requirements and can be placed physically within a case file or scanned and electronically maintained in accordance with a laboratory's policy.

At the conclusion of a forensic analyst's testimony, it is important to gain feedback from the court. Having a supervisor observe an analyst is effective to some degree, but getting direct feedback from attorneys and judges on the quality of testimony is exceptionally valuable. Written with ISO 17025 in mind, this form should be part of any digital forensic lab's quality system.

Part of controlling access to a digital forensic lab and ensuring evidence security and integrity is knowing who is within the laboratory space at any time. This visitor log is a simple, yet effective, way to document who is coming and going within the lab and was created with ISO 17025 in mind. Use within forensic labs that do not have an electronic access control system, or as a backup to electronic access systems.

Keeping track of forensic analyst workstations and the software installed on them is an important component of a laboratory system. Ensuring that workstations are patched for security vulnerabilities, have the latest software installed, and changes are tracked is important not only because conforms with cybersecurity best practices, but it also helps if findings are called into question years after an analysis has been completed.

Digital forensic investigations can vary greatly depending on the device, operating system, and even what evidence is being sought from the device. Even with a variety of reasons for conducting a forensic analysis, there are important steps that should be done in every exam. This checklist was created to help analysts who are performing forensic examinations of a Windows system and is designed with ISO 17025 in mind.

A curriculum vitae (CV) is an important document for digital forensic analysts to have and keep updated. Many analysts will include their CV as part of their expert report or may be requested to provide it in criminal or civil litigation. This customizable template allows an analyst to fill in their own education, experience, training, testimony experience, and other items and present a professional looking CV.