# March 7, 2001

# D R A F T

# Computer Forensics Tools Focus Group

# Charter and Rules of Operation

### INTRODUCTION

The National Institute of Standards and Technology (NIST) is partnering
with the U.S. Department of Justice's National Institute of Justice
(NIJ), the Federal Bureau of Investigation (FBI), the Defense Computer
Forensics Laboratory (DCFL), the U.S. Customs Service, and others to
develop programs for testing computer forensics tools used in the
investigation of crimes involving computers. As part of this effort,
focus groups of area experts from federal, state, and local law
enforcement organizations are being assembled to develop requirements
for each classification of tools. These requirements will be vetted by
consensus review from the communities that use the tools and from the
public. This document defines the objectives to be achieved by each
focus group and the processes by which they will operate.

### 2. FOCUS GROUP CHARTER

Each focus group (FG) assembled under this charter will have the major
objective of producing a requirements document that prescribes the
requirements for a specific classification of automated tools. Further,
the requirements may be subdivided into mandatory, i.e., those
requirements of which an implementation shall be capable, and optional
requirements, i.e., those that are not mandatory but which will be
treated as mandatory if the implementation purports to support them. (If
a tool supports an optional requirement, then it will be tested as if
the requirement were mandatory.) The requirements document will be used
as the basis for developing test assertions and abstract test cases that
will be used to develop specific implementations of tests that will show
whether a specific tool meets the requirements. The document must be
developed in a timely manner and may require one or more meetings of
focus group members in order to produce an effective document.
Additionally, the focus group will follow the specific process rules
defined in this charter to ensure that all interested parties have
access to participate and provide input.

### 3. MEMBERSHIP

Focus Groups will be comprised of three to seven members from NIST and
the law enforcement community. Representatives of law enforcement will
be officers or full-time employees of federal, state, or local
governments, or contractor representatives of government agencies. In
all cases, sponsoring government organizations must vouch for the
expertise of the representatives. For designated representatives who are
not federal, state, or local government employees, sponsoring
organizations must make certain that the representative understands that
he or she is attending in the stead of the sponsoring organization and
does not represent his or her employer.

Each FG will have a facilitator from NIST or one of the major sponsoring
agencies described in the introduction.

### MEETINGS AND SCHEDULES

Meetings will consist of an initial meeting and any follow-on meetings
that the FG requires to complete its work. All meetings will be held on
the NIST campus in Gaithersburg, Maryland.

Meetings will be scheduled to minimize conflict with individual member
needs, but consensus agreement shall rule. Schedules will be developed
to ensure timely delivery of requirements documents.

### 4.1 Initial Meeting

The initial meeting will provide information specific to a FG and
briefings on the process to be used.

### 4.2 Follow-on Meetings

Any meetings required after the initial meeting will be determined by
consensus of the membership of the specific FG. If the program of work
cannot be completed by the end of the initial meeting, the FG members
may elect to continue discussions at separate meetings or through the
use of email, listservers, chat rooms, telephone conferences, or any
medium that fits the requirements of the members. The FG facilitator
will arrange for facilities based on the needs of the FG.

### 5. PROCESS

The process for developing the requirements document is included in a
larger process used by NIST to implement a testing program. The specific
steps of this process are as follows:

a.  FG defines requirements

b.  Requirements are posted on web site

c.  Interested parties submit comments on requirements

d.  FG resolves comments

e.  Assertions are derived by NIST

f.  Assertions are posted on web site

g.  Interested parties submit comments on assertions

h.  FG resolves comments

i.  Abstract test cases are derived by NIST

j.  Test cases are posted on web site

k.  Interested parties submit comments on abstract test cases

l.  FG resolves comments

m.  Testing laboratory acquires commercial off-the-shelf (COTS) software

n.  Testing lab performs documentation review

o.  Testing lab selects test cases that apply to tool

p.  Testing lab develops test plan

q.  Testing lab implements test cases

r.  Testing lab executes tests and collects results

Items *a* through *l* are supported by NIST through the FG facilitator.
In most cases, the FG will be totally responsible for the requirements
development. (NIST will provide editorial support for putting the
requirements in the correct form.) Support for developing test
assertions and abstract test cases will be provided by NIST. NIST will
gather comments and submit them to all FG members for review and action
by the FG. Items *m* through *r* are included to illustrate the total
testing program process, but they will be carried out by NIST or other
independent testing laboratories accredited to perform the testing
required.

One of the initial acts of each FG will be to modify and ratify a
proposed schedule for completion of the FG's work.

### 6. RULES OF OPERATION

To enhance the autonomy of each FG, several rules of operation are laid
out in the initial meeting. These rules are described in the following:

1.  Members shall not contact any vendors or other organizations outside
    their own in discussions of the FG's work until such time as a
    requirements document has been posted on the web site for public
    comment.

2.  No copy of any FG working documents or drafts that have not been
    posted on the web site shall be distributed or given to anyone
    outside the member's organization.

3.  During the testing of a specific product, members may be contacted
    to gain input on the results of testing, planning of test
    parameters, and similar topics, but the information discussed shall
    not be given or distributed to anyone outside the member's
    organization.

The reasons for these rules are to provide control over draft documents
that may radically change before being posted on the web site and to
eliminate misunderstandings of discussions to the extent possible.
Consensus must be achieved before any documents are posted.

Members may submit recommendations for modifications to these rules as
the need arises. Final determination of rules changes will be made by
the NSRL/Tool Testing Steering Committee made up of representatives from
the major project sponsors.