Much of the testimony of a digital forensic expert involves educating the trier of fact on complex technological issues. A good indicator of a potential expert’s performance of their ability to fulfill that role is having conducted formal instruction or other presentations on digital forensic topics.
Digital Forensics is defined as the science of identifying, collecting, preserving, documenting, examining, and analyzing evidence from computer systems, the results of which may be relied upon in court. [2] It involves the use of a computer as a tool to not only obtain data from a digital device, but analyze that data to answer questions about it. The digital forensic examiner uses a host of tools in this process, from manually looking at the binary information of a file, to software that automates many processes examining evidence. The hallmark of these examinations is that they are repeatable, the work completed by examiner A should be able to be replicated by examiner B and achieve the same results. This is based upon the use of quality (and tested) tools, industry standards and best practices, and effective documentation. The very nature of this work is to meet any Daubert / Frye admissibility standards and allow for introduction in legal proceedings.
Much like any other product, the expert’s website is an attempt to put their best foot forward and impress potential clients. The site should be evaluated for content as opposed to entertainment value.
While certifications may be difficult to evaluate, they can be a very good method of uncovering a charlatan expert. Those who are not true experts, but purport to be, will often gravitate to certifications that are no more than a piece of paper to make an expert look legitimate.
Certification can be a strong indicator of proficiency in digital forensics, but like training courses, certifications may not all be equal. A certification could be as meaningful as in-depth written and practical proficiency testing, or little more than a piece of paper received for course attendance.
That being said, digital forensics is a relatively new field and degree programs are limited; it is important to evaluate the totality of an expert’s education and training when looking at knowledge.
Computer forensics is common in both corporate and criminal investigations, but a different burden of proof means goals and skill set s may be different, with the corporate examiner often not required to go as deep as the criminal investigator .