Digital Forensics and Discovery Management Are Certified Specialties

How electronic evidence is acquired can vary widely depending on whether the case is a criminal investigation, government investigation or civil litigation, but all these situations have common elements. Potential data sources have mushroomed so they now include, among others, PCs, servers, portable drives, tablets, mobile devices and the cloud. At the same time, circumstances have become more complex, often including cross-border data transfers.

The net result, the author says, is that the person managing evidence acquisition needs to be a specialized and highly trained expert. The author makes the case that, for those who need to retain this kind of expertise, formal certifications like CCE, or Certified Computer Examiner (under the aegis of the International Society of Forensic Computer Examiners) are a useful guide.
CCE training, the author says, is “technology-agnostic,” meaning it emphasizes defensible techniques of evidence handling, regardless of the specific technology employed. The fundamental principles remain the same: proper acquisition techniques; chain of custody documentation; complete, objective analysis and reporting; and thorough documentation to insure defensiblity.

The author notes differences between gathering data evidence in criminal versus civil cases, but he notes also that as technology improves and costs go down, forensic imaging is becoming a more common feature of civil as well as criminal matters. It has become more common for lawyers to capture a drive image of a custodian’s computer and then later extract email and documents containing material relevant to the litigation.