This article is intended to demystify some of the jargon involved in computer forensics and provide solicitors and barristers working in civil and criminal defence cases with a guide for the selection of a good computer expert.
FOR IMMEDIATE RELEASE
The old adage that you are only as strong as your weakest link, could not be more true where digital evidence is concerned. A good computer forensic expert will make your life easy, will clearly explain the digital evidence and any ramifications for your case. A poor computer forensic expert can easily compromise your case by not understanding or explaining the ramifications of the digital evidence. This will leave you attempting to demystify the complex jargon or worse still, with an inept report that compromises the evidence. This article is intended to demystify some of the jargon involved in computer forensics and provide solicitors and barristers working in civil and criminal defence cases with a guide for the selection of a good computer expert.
It is essential that your computer forensic expert is applying the principles of the ACPO Guide for Computer Based Electronic Evidence. This guide comprises a set of four principles that defines the minimum level of standards for the preservation and analysis of electronic evidence. They are:
PRINCIPLE 1: No action taken by Police or their agents should change data held on a computer or other media which may subsequently be relied upon in Court;
PRINCIPLE 2: In exceptional circumstances where a person finds it necessary to access original data held on a target computer that person must be competent to do so and to give evidence explaining the relevance and the implications of their actions;
PRINCIPLE 3: An audit trail or other record of all processes applied to computer based evidence should be created and preserved. An independent third party should be able to examine those processes, assess an exhibit, and achieve the same result;
PRINCIPLE 4: The Officer in charge of the case is responsible for ensuring that the law and these principles are adhered to. This applies to the possession of and access to, information contained in a computer.
The computer forensic expert should understand the principles of the ACPO Guide for Computer Based Electronic Evidence and should be working towards them.
Most criminal cases, and the majority of civil cases will be conducted using computer forensic software known as EnCase. This software is considered the 'de facto' for most computer forensic experts. It is used by computer forensic companies worldwide. It is therefore recommended that any computer forensic expert that you employ should be trained by Guidance, the producers of this software. A further measure would be to employ only EnCase Certified Examiners. EnCase Certified Examiners have passed a two-part competency test administered by Guidance themselves. This test not only tests the individual's proficiency with the software but with the discipline too.
You should request the computer forensic expert's CV and thoroughly scrutinise it. Do they have enough experience in computer forensics for your requirements? Do they have a lot of training behind them? You should also stipulate, once you are satisfied with an expert's CV, that the company will only allow this person to work on your case. Some computer forensic companies will have a team of investigators and may instruct a different person to actually carryout the work that you have requested.
Although some computer forensic experts may be qualified and experienced, they may not actually be able to write a report or explain terminology in a manner that is comprehensible by the layperson. We know, for example, of a number of professors of computer forensics who are extremely technically capable and experienced but they cannot write reports that can be understood by the layperson. If you're worried then talk to the expert and ensure that they can explain key terms and phrases to you. Ask to see examples of their reports too. You need to be happy that you will be able to understand the outcome of the investigation.
In conclusion you should ensure:
That the computer forensic expert is aware of and adheres to the ACPO Guidelines.
You have reviewed the computer forensic expert's CV: Are happy that they are experienced, knowledgable and sufficiently trained.
That the computer forensic expert is able to explain terminology if they are called to court and write reports that you can understand so that you can make the most out of the case.
UK Computer Forensics is a UK based computer forensics company with experienced and knowledgable experts that are all EnCase trained and work to the ACPO Guidelines. They can provide you with thorough and comprehensible reports and testimony as to their previous success in a courtroom environment. They can be contacted through their website at http://www.ukcomputerforensics.co.uk | 
