Chapter 28 — Further Reading

Foundations (🔬 deeper)

• National Research Council, Strengthening Forensic Science in the United States: A Path Forward (2009) and the PCAST report, Forensic Science in Criminal Courts (2016). The two documents that forced the whole field to reckon with how context warps expert conclusions. Read them to understand why objectivity is a procedure, not a virtue you assume you possess.
• Itiel Dror, papers on cognitive bias and "linear sequential unmasking." The research behind the chapter's bias defenses — how knowing the expected answer measurably contaminates analysis, and how sequencing the work guards against it.
• SWGDE Best Practices and ISO/IEC 17025 lab accreditation. The standards-level statement of validated methods, documentation, and competence that the codes of ethics assume.

Approachable explanations (everyone)

• Nelson, Phillips & Steuart, Guide to Computer Forensics and Investigations (Cengage) — the professional-conduct and ethics chapters. A classroom-friendly tour of objectivity, scope, and reporting duties alongside the tools.
• NCMEC and the ICAC Task Force program — public resources. Plain-language explanations of the CyberTipline, what reporting looks like, and why the handling rules exist; written for practitioners, not lawyers.

In practice (💾 Recovery · 🔍 Examiner · 🛡️ IR · 📜 Legal)

• 🔍 The codes themselves: IACIS, ISFCE (CCE), GIAC, and (ISC)² codes of ethics. Read at least one end to end — you will be asked on the stand which code you adhere to (Chapter 27).
• 📜 18 U.S.C. §2251, §2252/§2252A, §2256 (definitions), and §2258A–C; the 2024 REPORT Act. The statutory map of the handling and reporting regime — who must report, what is criminalized, and the narrow affirmative defense. Also look up your own state's computer-technician reporting statute (e.g., Mo. Rev. Stat. §568.110).
• 🛡️ Examiner-wellness guidance from NCMEC/ICAC and the vicarious-trauma / secondary-traumatic-stress literature. The organizational and personal playbook for surviving exploitation caseloads intact; treat it as required reading, not optional.
• 🔍 Project VIC, Griffeye Analyze, and Microsoft PhotoDNA (overviews). How vetted investigators triage known material by cryptographic and perceptual hash without rendering images — the technique that is also a well-being measure. (Access to the actual hash sets is restricted to vetted investigators.)
• 💾 Chapter 13 — The Data Recovery Business. The everyday-integrity, honest-quoting, and confidentiality ethics of the recovery trade, where most of these duties are met without a warrant in sight.

Reference (this book)

• Appendix E — Legal Frameworks Reference: §2251/§2252/§2256/§2258A–C, state laws, and the cross-border tangle, collected.
• Appendix F — Chain-of-Custody and Report Templates: the forms behind a content-free discovery log and an Authority & Ethics Memo.
• Appendix I — Certification Roadmap and Chapter 39 — Certifications: earning the credentials this chapter forbids you to fake.
• Chapter 25, Chapter 26, Chapter 27: the authority, the report, and the testimony this chapter's conscience operates inside.

Do, don't just read

• Run a hash-set triage. Build a small benign known-file list and run md5deep -m -k known.txt -r /mnt/practice_ro against a sanctioned practice image (Appendix J); confirm hits report by path and hash only. Internalize "find without looking."
• Write the memo before you need it. Draft the Authority & Ethics Memo (Exercise 28.26) for a practice case, including the contraband contingency in advance — having the procedure written before the moment is the whole point.
• Look up your own law. Find your state's mandatory-reporting / computer-technician statute and your professional body's ethics resource, and save both where you would actually reach them in a crisis.

Next: Chapter 29 — Encrypted Device Forensics: where strong cryptography turns "know your limitations" from a maxim into a daily fact of the bench, and the Fifth Amendment meets the password.