Scientific Working Group on Digital Evidence

Search current documents

Browse current documents

The Scientific Working Group on Digital Evidence (SWGDE) brings together organizations actively engaged in the field of digital and multimedia evidence to foster communication and cooperation as well as to ensure quality and consistency within the forensic community.

If these are your interests, we would like to welcome you to our site. We hope you will find the information found within to be of benefit.

Read more in About Us

Mary Horvath, Chair
Federal Bureau of Investigation

James Darnell, Vice Chair
US Secret Service


-- The September 2018 Meeting announcement, with hotel and travel guidance, has been emailed out to all members and approved guests. If you are a member or approved guest and did NOT receive the meeting announcement, please email the Chair. If you are new to SWGDE and would like to attend, you must first submit a Guest Attendance Request located on our Membership page. Please note the following deadlines:
---- The hotel room block is only being held until August 17th.
---- Funded members/guests must RSVP to the Chair by August 24th.
---- For state/local guests requesting travel funding, guest request must be received by August 24th.
---- For self-funded guests, guest request must be received by September 3rd.

-- Six new Drafts for Public Comment from the June 2018 meeting have been posted to the "Drafts for Public Comment" page (under "Documents"). Additional Drafts for Public Comment coming soon! ~ 7/25/2018

-- The four new Approved documents from the June 2018 meeting are now available on the "Current Documents" page (under "Documents"). ~ 7/11/2018
SWGDE is actively encouraging new membership! Learn about attending a meeting as a guest or applying for membership.
Newest Publications
SWGDE's most recent published documents are:
  • SWGDE Best Practices for Computer Forensic Examination
  • SWGDE Best Practices for Digital Evidence Collection
  • SWGDE Best Practices for Image Authentication
Provide Feedback
SWGDE seeks feedback from the DME community on our drafts for public comment:
  • SWGDE Best Practices for Mobile Device Evidence Collection, Preservation, and Acquisition
  • SWGDE Best Practices for Digital Forensic Video Analysis
  • SWGDE Best Practices for Portable GPS Devices

Myth of the Day

Once a forensic analysis is conducted, every item of significance to a case has been identified.
Category: All DME Myths
A digital/multimedia evidence examination can be an evolving processes. As investigative values come to light, either directly from the exam or from another source, different items can become relevant and need to be searched, interpreted, extracted, and reported. For example, a physical image is extracted from a seized cell phone pursuant to a search warrant. As requested in the warrant, the examiner reports on all call logs. Later, an investigator identifies contact with a collaborative witness but does not find in the report any further information regarding the witness. An additional warrant is secured if necessary and the examiner is provided the name of the witness and requested to find any other information. The examiner performs searches in unallocated space and recovers fragments of deleted emails from the collaborative witness.
See Myths