Part 2:- Quality assurance mechanisms for digital forensic investigations: knowledge sharing and the Capsule of Digital Evidence (CODE)

Despite potential numerous benefits, the field-wide sharing of knowledge in digital forensics is arguably still yet to be attained. Achieving this has attracted much practitioner and academic debate, yet solutions to two fundamental hurdles have yet to arguably be addressed; ‘how do we share knowledge’, and ‘what do we share’. Currently there a few viable protocols in place which tackle either of these issues forming a barrier to field-wide sharing. The focus of this work is to address the latter issue and guide practitioners on what content must be shared for any data to be of value to fellow professionals. This paper proposes the Capsule of Digital Evidence (CODE), a framework designed to set out the required elements for the sharing of reliable digital forensic knowledge. The CODE structure and its requisite contents are examined along with its applicability for supporting field-wide knowledge sharing in digital forensics.