skip navigation


Register for Latest Research

Stay Informed
Register with NCJRS to receive NCJRS's biweekly e-newsletter JUSTINFO and additional periodic emails from NCJRS and the NCJRS federal sponsors that highlight the latest research published or sponsored by the Office of Justice Programs.

NCJRS Abstract

The document referenced below is part of the NCJRS Virtual Library collection. To conduct further searches of the collection, visit the Virtual Library. See the Obtain Documents page for direction on how to access resources online, via mail, through interlibrary loans, or in a local library.


NCJ Number: 210177 Find in a Library
Title: Finding a Qualified Computer Forensic Analyst
Journal: Law Enforcement Technology  Volume:32  Issue:5  Dated:May 2005  Pages:122,124,126,127
Author(s): Jon Berryhill
Date Published: May 2005
Page Count: 4
Type: Instructional Material
Format: Article
Language: English
Country: United States of America
Annotation: This article explains the difference between a computer technician and a qualified computer forensic analyst and provides examples of the kinds of cases in which a computer forensic analyst is needed to identify and recover evidence.
Abstract: Unlike other forensic science disciplines, there are not any widely recognized certifications, education requirements, or skills-testing for computer forensics practitioners; however, there are companies, organizations, and colleges that offer various levels of training. Although these education and training sources may grant some form of testing and certification, none of these certifications are officially recognized as identifying people as computer forensics "experts." In the absence of uniform standards that ensure professional expertise for the work required, agencies must rely on their own research and word of mouth. This means that criminal investigators must gain sufficient knowledge of computer forensics to recognize whether a particular person is qualified to perform evidentiary identification and analysis on computers. Based on some knowledge of the field, the investigator charged with selecting a computer forensic analyst should ask a prospect about his/her experience, where he/she learned skills, and the investigative process used. In all circumstances, this process must include making an image copy of the evidence in a manner that physically locks the original evidence to prevent any changes from occurring. All examinations will then be performed on the image copy. Further, this image copy must be made with forensic imaging software. An expert will be able to explain his/her methods in layman's terms. The more experienced the analyst, the greater the variety of information he/she can deduce from the evidence. This article briefly describes six types of computer evidence that have been identified and analyzed by a computer forensic analyst.
Main Term(s): Police computer training
Index Term(s): Computer crime investigative Training; Computer evidence; Computer related crime; Personnel evaluation; Police personnel selection
To cite this abstract, use the following link:

*A link to the full-text document is provided whenever possible. For documents not available online, a link to the publisher's website is provided. Tell us how you use the NCJRS Library and Abstracts Database - send us your feedback.