U.S. flag

An official website of the United States government, Department of Justice.

NCJRS Virtual Library

The Virtual Library houses over 235,000 criminal justice resources, including all known OJP works.
Click here to search the NCJRS Virtual Library

Finding a Qualified Computer Forensic Analyst

NCJ Number
210177
Journal
Law Enforcement Technology Volume: 32 Issue: 5 Dated: May 2005 Pages: 122,124,126,127
Author(s)
Jon Berryhill
Date Published
May 2005
Length
4 pages
Annotation
This article explains the difference between a computer technician and a qualified computer forensic analyst and provides examples of the kinds of cases in which a computer forensic analyst is needed to identify and recover evidence.
Abstract
Unlike other forensic science disciplines, there are not any widely recognized certifications, education requirements, or skills-testing for computer forensics practitioners; however, there are companies, organizations, and colleges that offer various levels of training. Although these education and training sources may grant some form of testing and certification, none of these certifications are officially recognized as identifying people as computer forensics "experts." In the absence of uniform standards that ensure professional expertise for the work required, agencies must rely on their own research and word of mouth. This means that criminal investigators must gain sufficient knowledge of computer forensics to recognize whether a particular person is qualified to perform evidentiary identification and analysis on computers. Based on some knowledge of the field, the investigator charged with selecting a computer forensic analyst should ask a prospect about his/her experience, where he/she learned skills, and the investigative process used. In all circumstances, this process must include making an image copy of the evidence in a manner that physically locks the original evidence to prevent any changes from occurring. All examinations will then be performed on the image copy. Further, this image copy must be made with forensic imaging software. An expert will be able to explain his/her methods in layman's terms. The more experienced the analyst, the greater the variety of information he/she can deduce from the evidence. This article briefly describes six types of computer evidence that have been identified and analyzed by a computer forensic analyst.