supporting statement

NIST Blackbox Study for Digital Examiners

OMB Control #0693-0033

Expiration Date: 07/31/2022

NIST Generic Clearance for Program Evaluation Data Collections

FOUR STANDARD SURVEY QUESTIONS

1. Explain who will be surveyed and why the group is appropriate to survey.

The National Institute of Standards and Technology (NIST) is working to strengthen forensic science practices in the field of digital forensic by researching the results of digital examinations. Digital forensics is the branch of forensic science that involves the investigation and recovery of material found on digital devices (i.e. personal computer hard drives, mobile devices).

Requests for participation in this study will be handled through professional contacts, presentations at the American Academy of Forensic Sciences (AAFS) conference and participation in the Standards Working Group for Digital Examiners (SWGDE). This study will be announced on the NIST public websites, National Standard Reference Library (NSRL) and Computer Forensic Testing Tools (CFTT) which provide data resources to the digital forensic community.

This survey is targeting individuals who conduct digital examinations as part of their workplace duties. The participant pool is broad due to this discipline. Digital examinations are conducted for the purposes of law enforcement, criminal defense, intelligence, corporate security, incident response and possible other reasons. This survey is being conducted as part of the “NIST Black Box Study for Digital Examiners” which is evaluating the accuracy and reliability of conclusions made by digital examiners in digital investigations.

This group of individuals targeted for participation are most appropriate because of their expertise in digital discovery.

2. Explain how the survey was developed including consultation with interested parties, pre-testing, and responses to suggestions for improvement.

This survey was developed by consulting developers of past black box surveys to understand lessons learned from their approach. We consulted with experts from the digital forensic community who reviewed this work and provided technical input to this survey. The workflow and structure of this survey was beta tested by a small group of digital examiners. These steps were taken to improve the outcome of this study.

3. Explain how the survey will be conducted, how customers will be sampled if fewer than all customers will be surveyed, expected response rate, and actions your agency plans to take to improve the response rate.

This survey will be conducted in a manner to maximize participation and minimize any risk to digital examiner participants. Individuals interested in participating in this study will be asked to provide their consent through the online survey form. This form describes the purpose of the study, procedures for participation, and any risk to individual participants. Individuals who consent to participate in the survey will be asked to a series of questions about their work environment and background. This information will be used in the registration process.

We are expecting a 30% rate of response based on the number of people who consent to participate in this survey. To improve the rate of response, the survey is designed in a targeted manner by qualifying the participants as digital examiners and limiting the number of background questions. We estimate a total of 150 individuals will consent to participate with a response time of 10 minutes to complete the survey. The total estimated burden time is calculated to be 25 hours.

The survey will be available to the user community for 4 months. We expect a strong response to this study based on our community outreach. The administrators of this study are working with the user community by directly reaching out to leaders in the digital forensic field, joining standards working groups, and presenting this work at appropriate conferences. We are choosing our sample size based on our years of experience in the field of digital forensics and consulting with statisticians knowledgeable on survey design.

The survey will not collect participants’ name and data will not be saved within a Privacy Act System of Records. Because of this, a Privacy Act Statement and SORN are not applicable.

4. Describe how the results of the survey will be analyzed and used to generalize the results to the entire customer population.

The results of the survey will be analyzed by applying statistical methods to the collected data.

This survey will collect information of study participants such as work environment, experience and education. The study seeks to determine any relationship of the population parameters and accuracy in digital discovery. Any association between the participants experience, training and accuracy will be reported.