Finding a Qualified Computer Forensic Analyst

• NCJ Number: 210177
• Journal: Law Enforcement Technology Volume: 32 Issue: 5 Dated: May 2005 Pages: 122,124,126,127
• Author(s): Jon Berryhill
• Date Published: May 2005
• Length: 4 pages
• Publication Format: Article
• Publication Type: Instructional Material
• Language: English
• Country: United States of America

Annotation

This article explains the difference between a computer technician and a qualified computer forensic analyst and provides examples of the kinds of cases in which a computer forensic analyst is needed to identify and recover evidence.

Abstract

Unlike other forensic science disciplines, there are not any widely recognized certifications, education requirements, or skills-testing for computer forensics practitioners; however, there are companies, organizations, and colleges that offer various levels of training. Although these education and training sources may grant some form of testing and certification, none of these certifications are officially recognized as identifying people as computer forensics "experts." In the absence of uniform standards that ensure professional expertise for the work required, agencies must rely on their own research and word of mouth. This means that criminal investigators must gain sufficient knowledge of computer forensics to recognize whether a particular person is qualified to perform evidentiary identification and analysis on computers. Based on some knowledge of the field, the investigator charged with selecting a computer forensic analyst should ask a prospect about his/her experience, where he/she learned skills, and the investigative process used. In all circumstances, this process must include making an image copy of the evidence in a manner that physically locks the original evidence to prevent any changes from occurring. All examinations will then be performed on the image copy. Further, this image copy must be made with forensic imaging software. An expert will be able to explain his/her methods in layman's terms. The more experienced the analyst, the greater the variety of information he/she can deduce from the evidence. This article briefly describes six types of computer evidence that have been identified and analyzed by a computer forensic analyst.