SWGDE and SWGIT Standards for Digital and Imaging Evidence

In the early 1990s, digital evidence was entering courts without any agreed framework for how it should be collected, verified, or presented. Analysts from different agencies used different tools, documented their work in inconsistent ways, and testified without shared vocabulary. Defence lawyers noticed. Challenges multiplied.

The US federal agencies and professional communities responded by forming Scientific Working Groups. These were not regulatory bodies; they had no enforcement power. They were consensus groups, bringing together examiners, prosecutors, defence attorneys, academics, and equipment manufacturers to agree on baseline practices. SWGDE was formed in 1998. SWGIT had begun producing photography guidelines even earlier, in 1997.

The model worked precisely because it was voluntary and practical. A SWGDE document on write-blocking was written by examiners who actually used write-blockers, not by legislators who had never touched the hardware. Courts began citing the documents as evidence of professional consensus, which gave them indirect legal weight even without a mandate behind them.

SWGDE published dozens of documents over the years. The documents most relevant to multimedia forensic work fall into a few clusters, and understanding the cluster structure is more useful than memorising document numbers because SWGDE updates its publications and the version is material to any court challenge.

• Acquisition documents: Cover write-blocking requirements, imaging of DVR and NVR systems, and the handling of proprietary video formats. The core requirement across all of them is that the process must not alter the source media, and that any deviation from this must be documented with justification.
• Processing and analysis: Address how analysts may work on copies rather than originals, the version control of working files, and the documentation of tools used. Every processing step must be reproducible from the case notes.
• Video analysis specific: SWGDE's video analysis document covers de-interlacing, frame extraction, export formats, and the documentation required when video is converted from a proprietary DVR format to a standard container for analysis. The conversion itself is an evidence-handling step and must be treated as one.
• Competency and QA: Documents covering the minimum training and proficiency testing requirements for examiners, and the quality assurance system a laboratory needs to demonstrate consistent performance.

SWGIT produced a series of section documents, each addressing a specific imaging task. Section 1 covered system overview and documentation considerations. Section 7, the most cited, addressed the use of enhanced images in court. Section 14 addressed digital imaging technology and the admissibility considerations that distinguish digital capture from traditional film.

Three SWGIT principles became the baseline that courts expect examiners to follow. First, the original digital file must be preserved and all work performed on authenticated copies. Second, the enhancement process must be documented such that any peer can reproduce it. Third, the enhanced image must not misrepresent the original, meaning it cannot introduce detail that was not present in the original data.

The dissolution of SWGIT in 2015 did not leave its guidance without a successor. The Forensic Video Analysis and Facial Comparison subcommittees of OSAC have built on those principles, and the ANSI/ASB standards process for digital multimedia evidence follows the same documentation logic.

ISO/IEC 27037:2012 defines four roles: the Digital Evidence First Responder (DEFR), the Digital Evidence Specialist (DES), the Digital Evidence Manager, and the Digital Evidence Analyst, each with defined responsibilities. The DEFR is responsible for identifying, collecting, acquiring, and preserving digital evidence in a forensically sound state, meaning unaltered and documented. The standard requires that the DEFR understand the principles of evidence integrity, though laboratory expertise is not a prerequisite for the role.

1. Identify: recognise potential digital evidence and document the scene environment, including the state of devices (on, off, locked, connected to network).
2. Collect: take physical custody of devices or storage media, using write-blocking tools where possible to prevent alteration during transport.
3. Acquire: create a verified forensic copy, recording hash values at source and copy to confirm bit-for-bit accuracy.
4. Preserve: maintain an unbroken chain of custody and store evidence under conditions that prevent degradation, noting any exceptions with documented justification.

The standard is technology-neutral by design, applying equally to a USB drive seized from a suspect, a CCTV recorder removed from a retail premises, or a cloud-synced archive accessed under legal process. That breadth is both its strength and its limitation: the standard specifies principles, not tooling.

ISO/IEC 17025:2017 sets the requirements a testing laboratory must meet to demonstrate technical competence and produce reliable results. It covers two parallel areas: the management system (document control, nonconformance, complaints, proficiency testing) and the technical requirements (personnel, facilities, equipment, method validation, measurement uncertainty, and reporting).

Accreditation is the external audit mechanism. An accreditation body such as A2LA (US), UKAS (UK), or NATA (Australia) assesses the laboratory against ISO 17025, verifying that both the management system and technical requirements are met. The certificate issued specifies exactly which tests or analysis types are within scope. A laboratory accredited for DNA analysis but not for video analysis is not accredited for video analysis, regardless of examiner experience.

OSAC differs from SWGDE and SWGIT in one structurally significant way: its products go through the ANSI American National Standards process, with formal public comment periods, ballot resolution, and periodic mandatory review. SWGDE documents carried practical authority, but they were produced by a volunteer group without formal balloting. An OSAC-derived ANSI/ASB standard carries stronger procedural standing when challenged in court precisely because of that formal process.

The OSAC Forensic Video Analysis subcommittee has produced guidance on video evidence examination covering acquisition, authentication, and the reporting of findings. The Facial Comparison subcommittee addresses morphological and automated face comparison and is working toward an ANSI/ASB standard that would set minimum documentation and uncertainty-reporting requirements for face comparison evidence in court.