Computer examination
Sub-specialties: Data capture, Data examination
Forensic computing is a broad field which has not previously been
categorised. So for the moment we have chosen to limit the scope of
the registration scheme to
practitioners who capture,
examine or interpret the information on hard disks and data media
associated with stand alone PCs with an internet
connection.
The specialty does not at present cover communications data
traffic, network investigations, or evidence derived from larger or
more complex computer systems. Nor does it cover the assessment of
computer systems against contractual or fitness for purpose
criteria in civil litigation.
Data capture involves the retrieval of relevant data from
the subject equipment by a forensically sound process and the
creation of check data and logs to permit future
verification.
Data examination involves the identification and examination
of data that may be relevant to a case and the production of
information or exhibits to assist investigators or the court.
Note:
We
distinguish
between the investigative stages in this field and the evaluative
stage, which forms the specialty of
Computers (Data
evaluation) under the
Science &
Engineering Sector. Some practitioners work in only
one stage of the process, some in two, and a few in all three. More
information about
Data evaluation is presented
below.
You are welcome to
apply for
registration in more than one area, but you should consider
carefully whether you are likely to meet the required standard. You
should not apply in evaluation if you do not prepare opinion
evidence.
Download an application pack
Computing
Sub-specialties: Data evaluation
Forensic computing is a broad field which has not previously
been categorised. So for the moment we have chosen to limit the
scope of the registration scheme to practitioners who capture,
examine or interpret the information on hard disks and data media
associated with stand alone PCs with an internet connection.
The specialty does not at present cover communications data
traffic, network investigations, or evidence derived from larger or
more complex computer systems. Nor does it cover the assessment of
computer systems against contractual or fitness for purpose
criteria in civil litigation.
Throughout the three broad stages of the forensic process - data
capture, examination and evaluation - the practitioner makes
judgements about the appropriateness of tools and techniques and
the validity of their output. Stages in the process are revisited
to refine the eventual opinions. At all stages, practitioners
identify data that appear to be inconsistent with the
assessment.
Specialists in data evaluation are usually graduates in science
or engineering or have a long significant record of practical work.
They use their knowledge and expertise of computing to evaluate
computer data in the context of other evidence in the case and the
computing environment. This can include opinion of ways in which
computers may be used based on specific knowledge and experience.
They express opinions about, and attach significance to the actions
of computer users and consider alternative hypotheses. Given the
rate of change in the computer world, computer specialists are more
likely to encounter situations for which no previous standard
operating procedure exists. Therefore computer specialists may have
to devise appropriate methods to evaluate data and be able to
justify them.
Note: We distinguish between the evaluative stage and the
investigative stages (data capture and data
examination), which form the specialty of Computer
examination under the Incident Investigation Sector. Some
practitioners work in only one stage of the process, some in two,
and a few in all three.
Download an application pack