What is computer forensics? Having worked in the field of Computer Crime and Forensic Investigation for over 12 years it is a question that is quite often asked.
The clinical definition of computer forensics is the analysis of a computer system for the recovery of evidence that is currently on the system or has been intentionally deleted from a system to hide revelvant facts to a specific case. Child porn, adultery and other types of crimes
As an investigative tool computer forensics has become a valuable asset. Considering almost 70% of all written communications have started or been sent through the use of a computer. Which also means most of the evidence needed for a case is also located on that same system.
What does a good forensic investigator need to know?
1) A masterful knowledge of computer hardware and software
2) A thorough knowledge of the different operating systems that are currently in use today
3) Techniques used to hide information within the file structure
4) A working knowledge of at least 3 different forensic recovery tools.
(No one tool is right for every case)
5) The ability to create a well laid out report so that the information is easily understood by laymen that may be reviewing the report.
There are a lot of individuals that claim they are computer forensics investigators. It has been my experience nothing could be farther then the truth. Quite often any investigator that can turn on a computer self proclaims himself a computer investigator with out any real knowledge of a computer what so ever.
As evidence of this several states have required computer forensic investigators to be licensed as a private investigator. This practice just feeds fuel to the fire of incompetence. A forensic investigators job is simply to recover the information needed for a case and turn it over to an investigator to proceed with the investigation. The forensic investigators job is not to investigate the case. This makes as much sense as asking the local Wal Mart photo employee to be a licensed investigator to develop film for an investigator that is also part of the case not the investigation.
Computer forensic is a valuable tool when done by a professional in the field of computer forensics. Not the jack of all trades or the Private Investigator that has his hands full just doing investigations. I ask you this simple question the next time you need your broken arm set would you have your dentist do it for you? After all they are both doctors.
I am sure reading this you can see how ridiculous this sounds. No less ridiculous is it to have an investigator pass himself off as a computer forensic investigator.
If we are not careful the effort to force a forensic investigator to be licensed will instead encouraged already licensed investigators to take a stab at it eventually causing the demise of this valuable investigative tool.
John L. Snider
Director of Investigations SPI
www.silentprotocol.com or jls@nrsemail.com
|
