First 2 parts of this article is here ;
The number and type of the case that the legal computer forensic expert worked on must be questioned. The published articles and books and the conferences and meetings and trainings that expert involved in must be questioned as well. The information regarding the certificates, constant trainings and professional memberships of the expert must be requested. Details regarding the court and case experience must be requested from the legal computer forensic expert. The references and the opinion of the previous client and especially lawyers on the legal computer forensic expert must be obtained.
One of the important issues is finding a person suitable to the case team. The person from whom assistance is required must be reachable for answering the questions and must work without hesitant to achieve the best result.
The legal computer forensic expert will assist to simplify elaborate and complicated technical issues in the cases where resolving depends on key findings which are the part of the electronic evidence in the course of case. For instance, a legal computer forensic expert must prepare the answers to the general questions mentioned below during the interview:
- What are your qualifications?
Legal Computer Forensic Expert: All the legal computer forensic experts must focus on the characteristics that they find most important although the answer will be variable depending on education, experience and knowledge.
- What is Computer Forensic?
Legal Computer Forensic Expert: Computer forensic is “who, what, when, where and how” is electronic evidence. The legal computer forensic expert attempts to recover electronic data and analyze it by using special technique and tools.
- How would you describe a typical computer forensic Investigation?
Legal Computer Forensic Expert: an investigation covering Legal IT typically commences with having bit by bit image or copy of the suspected hard drive or electronic device.
- What is the second step after obtaining the device?
Legal Computer Forensic Expert: Legal Computer Forensic Expert uses the Computer Forensic recovery tools and techniques in order to recover and investigate erased and existing data on hard disc.
- Is it possible to alter, damage and modify the evidence in period between the date when the driver’s image is obtained to date?
Legal Computer Forensic Expert: Legal Computer Forensic Expert must ensure the retention period for the devices in his/her possession. This documentation will demonstrate where the device is, who keeps the possession and what the purpose of the possession is. Consequently, it is not possible to alter, damage and modify any evidence on driver when the image is taken.
Court Experience
When assistance is sought from a qualified legal computer forensic expert, it must be ensured that he/she is able to answer the questions on the general computer forensic subjects and the questions, which are directly related to the case, addressed to him/her in the course of his/her testimony.
The recovery of the electronic data requires two stage processes. First stage is obtaining the electronic data in an appropriate way. Legal computer forensic expert must have sufficient education and practical experience to obtain electronic data from the device irrespective of its type. In order to ease the exploration procedure, expert must be experienced in different types of devices and data types that will be examined and know how he/she will find the evidences very well.
Third part of this article is here ; Who Is Legal Computer Forensic Expert? – 4
Kaynak : 