| Standard ID | Contents [version] | USD | STEP2 | [PDF] delivered in | Standard Title (Description) | Status | PDF |
| GA/T 826-2009 | English | 199 |
Add to Cart
|
3 days [Need to translate]
|
Data recovery technical specifications of electronic forensics
| Obsolete |
GA/T 826-2009
|
PDF similar to GA/T 826-2009
Basic data | Standard ID | GA/T 826-2009 (GA/T826-2009) | | Description (Translated English) | Data recovery technical specifications of electronic forensics | | Sector / Industry | Public Security (Police) Industry Standard (Recommended) | | Classification of Chinese Standard | A92 | | Classification of International Standard | 13.310 | | Word Count Estimation | 4,496 | | Date of Issue | 2009-04-07 | | Date of Implementation | 2009-06-01 | | Quoted Standard | GA/T 825-2009 | | Regulation (derived from) | Ministry of Public Security Material Identification Center News April 15, 2009; industry standard filing notice 2010 No. 2 (No. 122); Ministry of Public Security Bulletin (2015.04.19) | | Issuing agency(ies) | Ministry of Public Security | | Summary | This standard specifies the method of data recovery verification in electronic evidence examination technology. This standard applies to electronic evidence testing in forensic science. | GA/T 826-2009: Data recovery technical specifications of electronic forensics---This is a DRAFT version for illustration, not a final translation. Full copy of true-PDF in English version (including equations, symbols, images, flow-chart, tables, and figures etc.) will be manually/carefully translated upon your order.
Data recovery technical specifications of electronic forensics
ICS 13.310
A92
People 's Republic of China Public Security Industry Standard
Technical specification for data recovery test of electronic physical evidence
2009-04-07 released
2009-06-01 Implementation
Issued by the Ministry of Public Security of the People 's Republic of China
Foreword
This standard by the National Criminal Technology Standardization Technical Committee Electronic Material Inspection Sub-Technical Committee (SAC/TC179/SC7) proposed
And centralized.
The drafting of this standard unit. the Ministry of Public Security evidence identification center.
The main drafters of this standard. Xing Guidong, Chu Chuanhong, Zhang Guochen, Yin Chunshe.
Technical specification for data recovery test of electronic physical evidence
1 Scope
This standard specifies the electronic material inspection technology in the data recovery test method.
This standard applies to the forensic science in the field of electronic evidence test.
2 normative reference documents
The terms of the following documents are hereby incorporated by reference into this standard. Whichever is the date of the reference file, which is followed by all
(Excluding corrigenda) or revisions do not apply to this standard, however, encourage the parties to reach an agreement under this standard
Whether you can use the latest version of these files. For undated references, the latest edition applies to this standard.
Technical specification for data search and inspection of electronic data
3 terms and definitions
The terms and definitions established in GA/T 825-2009 apply to this standard.
4 equipment
4.1 hardware
Storage media, security backup equipment, with a read-only interface of the electronic physical test workstation.
4.2 software
4.2.1 operating system. Windows, Unix, Linux, MacOS and so on.
4.2.2 Software Tools. EnCase, ForensicToolkit, X-WaysForensics, FinalData, EasyRecovery, FileRe-
covery, PhotoRecovery, RecoverMyFile, Recover4al, R-Studio, Macforensicslab and so on.
5 operating procedures
5.1 samples and sample numbers
List the samples and samples for inspection.
5.2 samples and samples taken pictures
Take pictures of samples and samples for inspection.
5.3 samples and sample preservation backup
The preservation of the conditions with the samples and samples of the preservation of backup.
5.4 Inspection
5.4.1 start anti-virus software on the electronic physical test workstation system antivirus.
5.4.2 Check the workstations via the read-only interface (if it is secured, using a secure storage device).
5.4.3 Restore data file method should be in accordance with the software tools to operate the instructions.
5.4.4 Filter the restored data to the inspection-specific storage medium.
5.5 Check out data recording
5.5.1 will test the data burned on the non-erasable blank disc, to use the seal to burn.
5.5.2 Unique number of discs.
5.5.3 affixed to the plate. Disk label should indicate the name of the inspection unit, CD number, date of inspection, etc .; stamp inspection and identification of special chapter.
|