ZEKASTRA

SOP-10 · Why the results can be trusted

Laboratory quality and tool validation

The quality system behind the procedures: tool validation, dual-tool checks, competence records and non-conformance handling, in the logic of ISO/IEC 17025.

01Purpose and scope

To be able to show that the tools produce correct results on this laboratory's equipment, that the people are competent for the work they sign, and that errors are found and corrected rather than hidden.

All tools, equipment and methods used in the procedures on this site, and all persons performing or reviewing examinations.

02Prerequisites

  • Reference data sets with known content and known hashes (for example, NIST CFReDS images and this site's synthetic samples).
  • A register of tools and equipment with versions, firmware and validation status.
  • Defined roles: examiner, reviewer, quality owner.

03Steps

  1. Validate each tool function before first use

    Define the function (for example: imaging, hash computation, timestamp decoding, SQLite parsing), run it against a reference set with known results, record the expected and observed values, and accept or reject the function for use. Re-validate after version changes.

    RecordValidation record per tool function and version.

  2. Verify critical results with a second method

    Findings that carry a conclusion (a decoded timestamp, a recovered record, a hash match) are reproduced with a different tool or by manual decoding from the raw bytes, and the agreement is recorded.

    RecordDual-verification lines in the examination log.

  3. Control equipment

    Write blockers are tested periodically with a known write attempt; workstations are documented with OS build and installed tools; reference clocks are checked against a time source and the offset recorded.

    RecordEquipment register and test log.

  4. Maintain competence records

    For each examiner: training, proficiency tests on reference cases, the procedures they are authorised to perform and review, and the date of the last assessment.

    RecordCompetence record per person.

  5. Handle non-conformances

    Any deviation from a procedure, tool error or review finding is recorded, its effect on past results assessed, corrective action taken and the affected requesters informed where results were released.

    RecordNon-conformance register.

  6. Retain and protect records

    Notes, custody records, validation records and reports are kept for the period required by the matter and the law, with access control and backup, and disposed of under a documented decision.

    RecordRetention schedule and disposal log.

04Records produced

  • Tool validation records
  • Equipment register and test log
  • Competence records
  • Non-conformance register
  • Retention schedule

05Pitfalls

  • A tool validated on one OS build or firmware is not validated on the next; version changes re-open the question.
  • Vendor test reports describe the vendor's environment, not this laboratory's.
  • Dual-tool verification with two tools that share the same parsing library is one verification, not two.
  • A non-conformance that is corrected silently cannot be shown to have been assessed for its effect on earlier reports.

06Forms

07Standards

  1. ISO/IEC 17025:2017 — General requirements for the competence of testing and calibration laboratories
  2. NIST — Computer Forensics Tool Testing Program (CFTT)
  3. NIST — Computer Forensic Reference Data Sets (CFReDS)
  4. ISO/IEC 27041:2015 — Assuring suitability and adequacy of incident investigative method
  5. ENFSI — Best practice manual for the forensic examination of digital technology