How to find and verify a computer forensic expert

Keys to hiring a qualified computer forensic expert
by Lee Haas

Computer forensics experts are skilled in various techniques used to recover and analyze data for use in a legal investigation. They have the ability to dig deeper and provide more than the average IT technician. When you are in need of a computer forensics expert, it’s important to know what to look for to ensure that the evidence provided is admissible in your situation.

What to look for in a computer forensics expert

Unfortunately, anyone with a little IT knowledge can try to pass themselves off as an “expert.” Finding a well-trained or certified computer forensics expert can be critical to ensure that evidence holds up in court, however. Certain states such as California have specific requirements and licensing regulations for computer forensics investigators. But in states that don’t, here are a few factors to consider:

• Experience: Does the expert have any legal or law enforcement background? What clients has she worked for in the past? Can he provide references or recommendations?
• Court approved: Has the expert previously been accepted by a court as an expert witness?
• Training: Has the expert participated in ongoing training and education? Technology changes fast and experts need to keep up in order to perform well.
• Professional associations: Is the expert a member of any professional organizations? These groups are a great way to share knowledge.

Computer forensics certification

Since there are no established licensing standards for computer forensic experts, professional certification can be an important factor in verifying an individual’s expertise. In fact, some government agencies require certification. Since professional certifications require a certain level of experience, and often require passing an exam, they provide a solid endorsement of the computer forensic expert’s skill. Two well-recognized certifications are the GIAC Certified Forensic Analysts (GCFA) offered by the Global Information Assurance Certification and the Certified Computer Examiner (CCE)® offered by the International Society of Forensic Computer Examiners.

How to locate an expert

Knowing what to look for is one thing, but actually finding an expert can be another challenge. The best way is usually word of mouth. Talk to any attorneys you may be associated with to see if they have recommendations. But luckily, since most of us don’t have every day dealings with attorneys, there are other resources to turn to. Professional organizations that provide listings of computer forensics experts.

• High Tech Crime Investigation Association: HTCIA provides an online listing of computer forensic examiners. The list is searchable by geographic location.
• International Society of Forensic Computer Examiners: The ISFCE provides an online listing of its Certified Computer Examiners (CCE)®.
• Global Information Assurance Certification: The GIAC provides a listing of GIAC Certified Forensic Analysts on its website.

Since individuals listed in these resources are either members or have earned certification, they are fairly reliable. However, its always a good idea to follow up on references to verify that your expert is accurately represented.