The Scientific Working Group on Digital Evidence (SWGDE) brings together organizations
actively engaged in the field of digital and multimedia evidence to foster communication
and cooperation as well as to ensure quality and consistency within the forensic
If these are your interests, we would like to welcome you to our site. We hope you will find
the information found within to be of benefit.
Mary Horvath, Chair Federal Bureau of Investigation
James Darnell, Vice Chair US Secret Service
-- The September 2018 Meeting announcement, with hotel and travel guidance, has been emailed out to all members and approved guests. If you are a member or approved guest and did NOT receive the meeting announcement, please email the Chair. If you are new to SWGDE and would like to attend, you must first submit a Guest Attendance Request located on our Membership page. Please note the following deadlines: ---- The hotel room block is only being held until August 17th.---- Funded members/guests must RSVP to the Chair by August 24th.---- For state/local guests requesting travel funding, guest request must be received by August 24th. ---- For self-funded guests, guest request must be received by September 3rd.-- Six new Drafts for Public Comment from the June 2018 meeting have been posted to the "Drafts for Public Comment" page (under "Documents"). Additional Drafts for Public Comment coming soon! ~ 7/25/2018-- The four new Approved documents from the June 2018 meeting are now available on the "Current Documents" page (under "Documents"). ~ 7/11/2018
SWGDE is actively
encouraging new membership! Learn about attending a meeting as a guest or
applying for membership.
SWGDE's most recent published documents are:
SWGDE Best Practices for Computer Forensic Examination
SWGDE Best Practices for Digital Evidence Collection
SWGDE Best Practices for Image Authentication
SWGDE seeks feedback from the DME community on our drafts for public
SWGDE Best Practices for Mobile Device Evidence Collection, Preservation, and Acquisition
SWGDE Best Practices for Digital Forensic Video Analysis
SWGDE Best Practices for Portable GPS Devices
Myth of the
Once a forensic analysis is conducted, every item of significance to a case has been identified.
Category: All DME Myths
A digital/multimedia evidence examination can be an evolving processes. As investigative values come to light, either directly from the exam or from another source, different items can become relevant and need to be searched, interpreted, extracted, and reported. For example, a physical image is extracted from a seized cell phone pursuant to a search warrant. As requested in the warrant, the examiner reports on all call logs. Later, an investigator identifies contact with a collaborative witness but does not find in the report any further information regarding the witness. An additional warrant is secured if necessary and the examiner is provided the name of the witness and requested to find any other information. The examiner performs searches in unallocated space and recovers fragments of deleted emails from the collaborative witness.