The Role of Legal Computer Forensic Expert
The role of the expert:
- determination of the views and required measures that will be taken in order to obtain and maintain data,
- actions such as booting and starting the system may change critical time information and other confidential evidences,
- the discs which are used for back-up re-writes on the former evidences
- system maintenance activities such as deleting, de-fragmentation or compression may alter and damage the evidences,
- saving new data may re-write on existing data
- installing a new software on any media along with data re-writes on evidences
- running the anti-virus software may alter the data
- the problems of reaching and reading legacy data which was created by the outdated software and hardware
- transfer of the data to a new device may cause data loss
- no research will be carried out smoothly in mixed back-up discs
- preparation of the evidences to the court in desired format
- testifying before the court on the chain of evidence maintenance
What Characteristics should the Legal Computer Forensic Expert have?
Arthur Anderson, Enron Scandal, experiences of Bill Gates in Anti-trust case, interrogation of the former USA president Bill Clinton, Playboy case and many cases which take legal computer forensic expert and concept of computer forensic under spot lights…. These high profile cases had a common point: the efforts of the lawyers to search for the undisputed evidences that are in the computer hard discs, laptops, back-up discs and other electronic devices. In such incidents, lawyers are to demand the assistance of the legal computer forensic experts in order to reach, examine and evaluate the electronic data.
Apart for the activity that is carried out, legal computer forensic expert must demonstrate that he/she has the technical expertise that is required to assist the court or person who seeks assistance to comprehend and evaluate digital data. What are the criteria that must be taken into account when sought assistance from a legal computer forensic expert?
There is no difference between seeking assistance from a legal computer forensic expert and seeking assistance from other experts in the course of the case. In an arson case, an experienced expert is sought to identify the incident or in the cases arisen out of incorrect medical attention, experienced medical doctors who are specialist in the same type of medical attention is sought. Likewise, in computer forensic cases, depending on the type of the technical situation, a person who has proven experience in similar cases must be sought. For instance, contrary to examination of a large corporation’s IT network, different features are required to be possessed in cases where a single hard disc’s forensic examination needed. If data recovery will be carried out on computer devices, additional experience will be required.
While evaluating an expert’s technical and professional abilities, it is essential to look at the expert’s CV and resume in the first place. Within this scope, what must be questioned is that whether or not the legal computer forensic expert has the certification in different software and hardware, training and experience, knowledge of outdated software and legacy system programming languages, being familiar with different sequences of software and hardware, knowledge of advice, analysis, recovery, testimony in protection sequence and legal requirement in admissibility of evidence.,
Third part of this article is here ; Who Is Legal Computer Forensic Expert? – 3
