Re: [sleuthkit-users] Tool acceptance (was RE: Sleuthkit install problem)

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On May 27, 2004, at 3:52 AM, Angus Marshall wrote:
> As for acceptance - in English and Scots law (two different legal 
> systems over
> here), the basic principle is that once a technique has been accepted 
> by one
> court in either legal system, it is accepted by all courts within the 
> same
> legal system of an equivalent or lower level (rulings in England have 
> no
> effect in Scotland and vice-versa). Thus acceptance in Crown Court 
> implies
> acceptance in Magistrates court too. It doesn't mean that the results 
> or the
> technique were correct, but that the court accepts them as valid.

But how does one show that the results are valid when there are no 
standards to compare it with?  You can show that the same result can be 
found with tool X, which is already accepted, but on what basis was the 
first tool accepted?  Take NTFS for example.  There is no official 
specification for it and every tool may be using a different technique. 
  Does that matter when it comes to court acceptance?

thanks,
brian

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAtfWmOK1gLsdFTIsRAt81AJwNtd1Cfq4ivUySu9tScU+60Md/VACePwxp
t96DXuqjgy5dqCjcFKUbFio=
=1+iq
-----END PGP SIGNATURE-----