Re: [sleuthkit-users] Tool acceptance (was RE: Sleuthkit install problem)

[Angus M. <an...@n-...>]

On Thursday 27 May 2004 15:05, Brian Carrier wrote:
> On May 27, 2004, at 3:52 AM, Angus Marshall wrote:
> > As for acceptance - in English and Scots law (two different legal
> > systems over
> > here), the basic principle is that once a technique has been accepted
> > by one
> > court in either legal system, it is accepted by all courts within the
> > same
> > legal system of an equivalent or lower level (rulings in England have
> > no
> > effect in Scotland and vice-versa). Thus acceptance in Crown Court
> > implies
> > acceptance in Magistrates court too. It doesn't mean that the results
> > or the
> > technique were correct, but that the court accepts them as valid.
>
> But how does one show that the results are valid when there are no
> standards to compare it with?  You can show that the same result can be
> found with tool X, which is already accepted, but on what basis was the
> first tool accepted?  Take NTFS for example.  There is no official
> specification for it and every tool may be using a different technique.
>   Does that matter when it comes to court acceptance?
>

That's my whole point - in an adversarial system there is no concept of 
absolute proof or correctness. Ultimately, it comes down to which side has 
the more believable witness, therefore most of the work, in court, for an 
expert witness is about proving their expertise before going on to discuss 
the evidence itself. By accepting the expert, the court accepts his/her 
opinions and practices as used in the case. Law in a courtroom is all about 
precedents and interpretations of legislation.