FINDING AND SELECTING
A COMPUTER FORENSIC EXPERT

By: Gregory L Fordham
CPA, CIA, CCE, Sec+, MCP, Live, Stego

Introduction
Finding a Computer Forensic Expert
Selecting a Computer Forensic Expert
Criminal vs. Civil
Presentation Skills
Forensic Tools
Case Specifics
Industry Specifics
Relevant Experience
Training
Educational Background
Certifications
Conclusion

Introduction

As digital evidence continues to become more common in litigation, so has the need for computer forensic experts. 

Computer forensics is often defined as the application of numerous science and engineering disciplines to the legal problem of digital evidence.  Said another way, it is the application of computer skills and knowledge in a litigation environment to examine, analyze and interpret computer related evidence.

Although most people consider computer forensics to equal imaging and analyzing computer hard drives, this is actually only a portion of computer forensics based on the above definition.  Under the above definition virtually anything digitally or computer related could be computer forensics once the problem is placed in a litigation context.

Computer forensics can be distinguished from another discipline used by lawyers known as electronic discovery.  Electronic discovery is the collection and production of digital evidence in a litigation environment.  It can be distinguished from computer forensics in that it lacks the examination, analysis and interpretation of the data.  Rather, e-discovery considers only the relevancy of the data to the legal matter as well as its compliance with various legal criteria such as “attorney client privilege” and “attorney work product”.  When viewed on a time line, electronic discovery can be the precursor to computer forensics, since it can provide the data that the computer forensic expert will examine.

Another term worthy of consideration is data recovery.  While computer forensic experts may utilize data recovery, data recovery is not computer forensics.  Computer forensics is practiced in a manner that preserves potentially relevant evidence.  Data recovery by itself does not claim to provide this safeguard.  For example, both the data recovery expert and the computer forensic expert can use the same tools and skills for recovering deleted data.  The computer forensic expert would employ practices that prevent the recovery of deleted data from damaging or destroying other potentially relevant evidence.  The data recovery expert would not necessarily take such precautions.  Rather, the data recovery expert may just recover the data to any available free space on a medium.

In some areas of modern litigation, the entire case is driven by the findings of computer forensic experts.  Even in garden variety e-discovery cases, where one would think that the challenges are simply the efficient and timely exchange of documents, the aid of a computer forensic expert can be essential to assess document authenticity, production compliance and the existence of spoliation.

Once the need for a computer forensic expert is recognized, the next likely hurdle will be how to find and select one.  To the uninitiated, this may seem no more complicated than an inquiry with a colleague.  However, there are more things to consider, particularly now as the number of those claiming to have this expertise grows to meet demand.  The following sections provide guidance to the litigator on finding and selecting a computer forensic expert.

Next>

Printable Version

Page 1