Six Articles on Electronic - Craig Ball

Craig Ball © 2007
Climb the Ladder
By Craig Ball
[Originally published in Law Technology News, February 2007]
Though computer forensics is a young discipline, it's not the exclusive province of new
graduates of computer forensics degree programs. It's a natural career extension for IT and law
enforcement professionals and peripatetic lawyers with a dominant geek gene. Expertise in
litigation and computer forensics also opens the door to lucrative opportunities in electronic data
discovery consulting. Here are "The Eight Es" to becoming a skilled CF expert:
1. Exploration...The lion's share of CF knowledge is self-taught. The best examiners are
insatiably curious and voraciously read about software, hardware, registry keys, root kits, etc.
They live for figuring out how it all fits together. Fortunately, there's a wealth of information: in
books (search Amazon.com for "computer forensics") and online (www.e-evidence.info) in
discussion forums, product FAQs, user groups and confabs.
2. Education...A computer science or law degree is nice, but you can study animal husbandry
so long as you go on to study CF in a comprehensive way. Professional certifications that
legitimately demonstrate training, testing, and practical experience have value in helping courts,
clients, and potential employers assess your qualifications. Supplement your college degree
with as many courses and certifications as your time and budget allow.
Excellent programs are offered by universities, vendors, professional associations, and the
government, such as New Technologies Inc., (www.forensics-intl.com), Guidance Software
(www.guidancesoftware.com), Access Data (www.accessdata.com), the International High
Technology Crime Investigation Association (www.htcia.org), the International Association for
Computer Information Systems (www.iacis.org), and the Federal Law Enforcement Training
Center (www.fletc.gov). But don't fool yourself into thinking that a week-long boot camp will
qualify you as a CF expert. In a battle between an experienced examiner and one with an
advanced degree, juries may defer to the latter. Some jurisdictions require licensure to perform
forensic investigations.
3. Experimentation...The ability to construct illuminating experiments and the patience to elicit
data are hallmarks of a skilled examiner. If you need to know how metadata changes when a
user touches a file, you'll be prepared to testify if you've proven your theory by competent
experimentation. Experiment with systems, applications, and operating systems to understand
how they work.
4. Experience...There's no substitute for applying your skills and testifying in real cases. How
can you get that experience? Apprentice to a veteran examiner or offer to perform a "shadow
exam,"to see if you find something he or she missed. Assist attorneys or local law enforcement
at little or no cost.
5. Exchange...Every examiner benefits from the exchange of ideas with colleagues. Join
industry associations, go to meetings, subscribe to online discussion groups, and unselfishly
share what you learn. Caveat: the CF community is very supportive, but other examiners may
justifiably regard you as a competitor, so don't expect them to reveal all. Show respect by doing
your homework. Be a learner, not a leech.
118