Text Version of Instrument

NIST Blackbox Study for Digital Examiners

NIST is conducting a blackbox study to evaluate the accuracy and reproducibility of digital discovery by digital examiners. Participation is open to digital examiners who conduct hard drive or mobile examinations as part of their official duties.

Listed is a brief summary of key information to describe the research study you are being invited to participate in. You will find more detailed information explained later in the informed consent section.

• Voluntary Consent: You may be eligible to participate in this research study. Taking part in this study is completely voluntary and you can withdraw at any time.

• Purpose: This survey will assist the forensic community in assessing the accuracy, reproducibility and repeatability of conclusions reached by digital examiners as part of their digital discovery process.

• Duration: We anticipate that your participation in this research study will take approximately 2 hours to complete.

• List of Procedures and Activities: You will be asked to complete an online survey about your current work place environment (i.e. lab type, number of examiners, examination types) and background information (i.e. education, training) followed by an off-line simulated case analysis. The simulated cases are designed for computer hard drive and/or a mobile phone analysis. Your answers to this analysis will be tallied through our NIST online survey form.

• Risks or Discomforts; Reasonable, expected benefits: We do not anticipate any risks with your participation in this study. It will require some of your time to complete the study analysis and survey forms. This study is important to the forensic community because it may well increase continual trust in the current progression of digital analysis methods.

NOTICE

OMB Control #0693-0033

Expiration Date: 07/31/2022

This collection of information contains Paperwork Reduction Act (PRA) requirements approved by the Office of Management and Budget (OMB). Notwithstanding any other provisions of the law, no person is required to respond to, nor shall any person be subject to a penalty for failure to comply with, a collection of information subject to the requirements of the PRA unless that collection of information displays a currently valid OMB control number. Public reporting burden for this collection is estimated to be 10 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed and completing and reviewing the collection of information. Send comments regarding this burden estimate or any aspect of this collection of information, including suggestions for reducing this burden, to the National Institute of Standards and Technology. Attention: Barbara Guttman (barbara.guttman@nist.gov).

* Required

Blackbox Survey for Digital Examiners Informed Consent Form

Principal Investigator: Barbara Guttman

Study Title: Blackbox Study for Digital Examiners

Study Site(s): National Institute of Standards and Technology, Gaithersburg Md 20899

Introduction: This document in its entirety is called an informed consent form. Please read this information carefully and take your time making your decision. Ask the researcher or study staff to discuss this consent form with you, please ask him/her to explain any words or information you do not clearly understand. The nature of the study, risks, inconveniences, discomforts, and other important information about the study are provided. You are being asked to take part in a research study that we intend to be solely voluntary by application. Participates interested in this research include only people who choose to take part in this study.

Purpose of the study: The purpose of this study is to identify and evaluate the body of scientific evidence that underlies the methods and practices used when conducting digital forensic examinations.

Why are you being asked to take part? This study is targeting individuals who conduct digital examinations on computer hard drives or mobile phones as part of their workplace duties. The participation pool is broad due to this discipline. You may be conducting digital exams for the purposes of law enforcement, criminal defense, intelligence, corporate security, incident response and other reasons.

Study Procedures: The initial step in this study is for participants to fill-out a survey with workplace and background questions. We estimate this step to take 10 minutes to complete. We are seeking information on your workplace environment such as the lab type, size location and accredited status. This is followed by a section with questions on the participants background like years of work experience, education level, educational study focus, training, testing and certifications.

At the end of the survey, you will be asked to provide your work email address. We will email you with a registration id and instructions for downloading the images needed for conducting an analysis on a

simulated case for a hard drive or mobile device. Once you have completed the off-line examination, you will need to return your answers to this study through another survey form. Your responses to this portion of the study will be linked to your registration id. It is estimated to take about 2 hours per image to perform this analysis.

Total Number of Participants: About 150 individuals will take part in this study by NIST.

Alternatives / Voluntary Participation / Withdrawal: You do not have to participate in this research study. You should only take part in this study if you want to volunteer. You should not feel that there is any pressure to take part in the study. You are free to participate in this research or withdraw at any time. There will be no penalty or loss of benefits you are entitled to receive if you stop taking part in this study. If at any time you choose to withdraw, all data you provide during the data collection phase will be deleted and will not be included in the final study analysis. You can choose to enroll in this study by completing the first survey (work type and background questions) and not complete the off-line simulation test without penalty.

Risks or Discomfort: This research is considered minimal risk. That means that the risks associated with this study are the same as what you face every day. There are no known additional risks to those who take part in this study. There is also a very small risk that someone who is not authorized could get access to the data we have stored about you. However, we describe how we will protect your privacy and confidentiality in a later section of this consent form.

Benefits /Compensation /Costs: You will receive no benefit(s) by participating in this research study. You will receive no payment or other compensation for taking part in this study. It will not cost you anything to take part in the study.

Privacy and Confidentiality: We will keep your study records private and confidential. The test results will be confidential. Respondents will not receive test scores, nor will we publish the answer key. The only direct identifier for this study is your work email address. We will use this data point to verify that you work in the type of lab you described. Once the data collection for the study is complete we will delete your email and the system used to manage the registration ids will be deleted. All answers to the questions provided in this study will not be able to be associated with either an individual or a specific lab.

Certain people may need to see your study records. Anyone who looks at your records must keep them confidential. These individuals include Barbara Guttman, the Principal Investigator and the research team. Your identity will be protected to the extent permitted by law, including the Freedom of Information Act. We may publish what we learn from this study. If we do, we will not include your name. We will not publish anything that would let people know who you are. Total confidentiality cannot be guaranteed, since all security measures have vulnerabilities and may be compromised.

Future use of research data: We will not retain your information for future research after this study.

Relevant research results: The overall results and findings from this study will not be shared with you. Respondents will not receive test scores results nor will the answer key be published. We will publish a report of our findings at the end of this study.

If you have any questions, concerns or complaints about this study, call Barbara Guttman at (301) 9754207. If you have questions about your rights as a participant in this study, or have complaints, concerns or issues you want to discuss with someone outside the research team, call the Human Subjects Protection Office at (301) 975-5445.

1 I freely give my consent to take part in this study. I understand that this is an online consent form and that by choosing yes on this form means that I am agreeing to take part in the research. Do you consent to participate in this study? * Mark only one oval.

Yes Skip to question 2.

No Stop filling out this form.

Workplace and Work Type

2. What is the size of your local lab? *

Local lab is the size of the lab where you work. Base your answer on the number of digital examiners, analysts or people with similar roles. Mark only one oval.

Small (less than 5 people)

Medium (6 to 20 people)

Large (more than 20)

2. What is the size of your lab system? *

Is your lab part of a bigger digital forensics lab system? If so, how big is the lab system? Base your answer on the number of digital examiners, analysts or people with similar roles. Mark only one oval.

Medium (less than 20)

Large (more than 20)

Not applicable

2. What is your lab type? * Mark only one oval.

Federal

State

Local/Tribal

Foreign (non-US) Government

Private/Independent

Other

2. What is the primary type of work? * Mark only one oval.

Law enforcement

Criminal defense

Criminal prosecution

Intelligence or similar

Civil

Incident response/computer security

Other

6 Is your lab accredited? * Mark only one oval.

Yes

No

In progress

7. Lab location? * Mark only one oval.

USA

International

Training and Experience

8. How many years have you worked as an examiner/analyst * Mark only one oval.

Less than 5 years

5 years to 10 years

More than 10 years

8. What is your level of education? *

Level of education attained Mark only one oval.

High School (or equivalent)

Associate degree

Bachelors

Graduate (Masters)

Doctorate

8. What was your focus area of educational study? * Mark only one oval.

Computer Science

Information Systems

Criminal justice or forensic science

Other

8. Are you a full-time examiner? * Mark only one oval.

Yes

No

12 Have you ever testified in court as a digital examiner expert. * Mark only one oval.

Yes (with in the past year)

Yes (more than a year ago)

No

13. How much training as an examiner have you acquired? * Check all that apply.

Tool vendor based with over 40 hours in the last 5 years

Tool vendor based with less than 40 hours in the last 5 years

Other external training over 40 hours in the last 5 years

Other external training under 40 hours in the last 5 years

13. Have you completed a certification program as a digital forensic examiner? * Mark only one oval.

Tool vendor certification

Professional association/agency or other non-vendor certification Other

13. Have you passed a proficiency test in the last 5 years? * Mark only one oval.

Yes

No. I attempted but did not pass

None taken

13. What test type will you take for the study? * Mark only one oval.

Hard Drive

Mobile

Both

13. Enter your work email. *

Enter your valid work email address. Once this information is submitted to NIST, you will receive an email with a registration Id and instructions for downloading and taking the digital examiners test.

Powered by