Re: Tools accepted by the courts

I'm not convinced that public humiliation is the way to go.  The way that 
credibility is maintained in our field is through doing our job with 
thoroughness, accuracy and excellence, both in the laboratory and in the 
courtroom.
Can I suggest that the proliferation of substandard examiners is the result of 
treating computer forensics as an offshoot of information security?  Police 
officers are trained to investigate, but forensic analysis is a much more 
specialized focus, regardless of the evidence examined.  A trained police 
investigator will know for example how to properly secure a firearm for 
forensic examination, but won't necessarily know the full nuances of ballistics 
forensics (striation, headstamp analysis, ballistics chemistry, etc).
I came into this field as a forensic chemist, so it is easier for me to see a 
suspect computer as a crime scene than a information security breach.  When 
seen as a crime scene, then the same evidence handling concepts and forensic 
principles apply as for any form of tangible evidence.  Perhaps it might be 
time for the information security arena to stop regarding computer forensics as 
a subset of IT investigation, and see it instead as a completely separate 
entity.

Just my thoughts,

Tobin