PI or Techie? Trying to Define Computer Forensics Experts
As computer forensic evidence becomes more popular and critical to litigation, it’s no surprise that a debate is starting over the type of training required to gather and present digital forensic evidence. A proposed law in South Carolina is raising some eyebrows for the stance it takes on this type of evidence. The pending legislation would require that digital forensic evidence collected for use in court be gathered by a licensed private investigator (PI) or through a licensed PI agency. Many are taking exception to that because of a general lack of computer training and education in PIs. Those who are trained to follow a possible cheating spouse or track down a lost relative are not always well versed in searching computer hard drives and network logs, opponents of the legislation say.
A recent Baseline article details the efforts by South Carolina and other states to require a PI license for collecting digital evidence. An ad-hoc advisory committee has been formed in South Carolina to better define requirements for digital forensic professionals. That committee’s guidelines are being modeled after failed Nevada legislation that recommended 18 months’ experience, a Bachelor’s degree in computer forensics and a Certified Computer Examiner (CCE) credential or equivalent.
We’ve discussed computer forensics evidence in this blog before and have great respect for those who do it. Having seen how complicated forensic evidence gathering can be and how crucial the results are to litigation, we like the more stringent recommendations originally proposed in Nevada. Many fail to realize the complexity of computer forensics but these guidelines recognize the delicate balance between investigative experience and technical background necessary to be a successful computer forensics expert.