Six Articles on Electronic - Craig Ball

Craig Ball © 2007
6. Equipment...Learn the tools and techniques suited to the task, and invest in them. Use
quality hardware and properly license software. Keep applications up-to-date, test tools to insure
they're reliable. Cross-validate results. Too many people confuse buying tools with acquiring
skills. A well-trained examiner can do the job with a hex editor and a viewer. We use forensic
suites, such as Guidance Software's EnCase or Access Data's FTK, to automate routine tasks,
improve efficiency, and lower costs — but buying a program doesn't makesyou a ready expert.
7. Earning...The demand for examiners is growing, but it takes marketing skill and financial
acumen to create a thriving business. You must attract and serve quality clients, and make ends
meet, to transform opportunity into achievement. Consider a first job with established CF
companies or law enforcement, not only for a steady income, but for the training. Starting
salaries average $50,000 to $75,000, but in the private sector, quickly rise to six figures as you
gain experience and responsibility. (Examiners with J.D.s or network security skills command
higher salaries.)
Many CF firms charge clients $250 to $600 per hour, so it's not unrealistic for entrepreneurial
examiners to hang out their shingles after learning the ropes. Expect $25,000 in minimum
startup costs for hardware, software and training. Overhead will vary on whether you operate
from your home or offsite.
8. Essential Element — Character...The final "E" is the "essential element" — character. A
successful examiner is at once, teacher and student, experimenter, skeptic, confidante,
translator, analogist, and raconteur. He or she unearths the human drama hidden in the
machine. So many qualities distinguish the best examiners — integrity, tenacity, technical skill,
imagination, insatiable curiosity, patience, discretion, attention to detail, and the ability to see
both the forest and the trees. Ultimately, it's your character that will determine if you'll be a top
computer forensics expert.
Craig Ball, a member of the editorial advisory boards of both LTN and Law.com Legal
Technology, is a trial lawyer and computer forensics/EDD special master, based in Austin,
Texas. E-mail: craig@ball.net.
119