FINDING AND SELECTING
A COMPUTER FORENSIC EXPERT
Evaluating a computer forensic expert’s educational background is not like evaluating those of a licensed engineer, medical doctor or accountant. By comparison to these other professions, the entire computer industry is relatively new. Someone with twenty years experience dates to a time when there was not even an abundance of degreed offerings, if any.
While there are more generalist degree programs today such as computer science, information systems, software engineering and the like, even they are not designed with the skills that computer forensic experts are likely to use. So, there may be no real advantage to experts having such credentials. Furthermore, educational degrees are not even required in order to qualify as an expert, although the litigator may want to use such credentials as a means to separate candidates.
In more recent times, there are degree programs in computer forensics that are starting to appear in college curriculum. While these are likely to provide a good foundation to those having them, again they are only a foundation. If anything, their usefulness may signal the seriousness at which the holder, pursues his career. On the other hand, in some esoteric areas it is unlikely that a worthy expert would have need of such designations.
Certifications
Like educational degrees, professional certifications in computer forensics are rather a recent commodity. So, it could be likely that computer forensic experts will not have forensic certifications. Of course depending on the nature of the case a forensic certification may not be necessary.
Computer forensic certifications generally deal with media files systems, operating systems, and interpretation of their artifacts. In some scenarios such as network or software functionality the classic computer forensic skillset may not be needed. Rather, more traditional computer system operation is all that is necessary.
So, litigators should realize that with respect to computer forensic certification there are relatively few and most of those are tools specific. Examples of tools specific certifications are the Guidance Software, the makers of EnCase, EnCE [EnCase Certified Examiner] and Access Data’s, the makers of the Forensic Toolkit, ACE [AccessData Certified Examiner]. Of course there are still others but these two examples are probably the best known.
Examples of the non-tool specific certifications are the Certified Forensic Computer Examiner (CFCE) that is offered to law enforcement personnel only by IACIS. Another generalist certification is the Certified Computer Examiner (CCE) offered to anyone by the International Society of Forensic Computer Examiners (ISFCE).
Beyond these classical forensic certifications are numerous operational certifications. Some of these include those offered by vendors like Microsoft such as the Microsoft Certified System Engineer (MCSE) and Microsoft Certified Professional (MCP) to name a few of the Microsoft certifications. Many other vendors offer their own certifications as well such as Cisco Systems with their Cisco Certified Network Administrator (CCNA).
There are also generic certifications offered by industry associations such as the Computer Technology Industry Association (CompTIA).
Despite the increasing availability of computer forensic experts, selecting them is becoming more difficult. It is not that there are fewer of them. Quite the opposite is true. There is much more to choose from and as such the search can be more complicated and time consuming.
Furthermore, computer forensics is not some kind of single subject discipline. While most people may think of them as hard drive examiners, the field is much more diverse than that. Also, as computers continue to permeate more and more of our society and legal system, the number of specialties and nuances increase accordingly.
So there is much to consider when selecting the right computer forensic expert. One size does not fit all. Making the correct choice can involve a multitude of considerations.
In the end, picking the right choice for a computer forensic expert in a particular litigation just depends. But would you expect anything less?
-End-
<Previous
Printable Version
Page 4 |
