1st Response Posting
Student discussion (Robert): Several states have adopted a licensure requirement in order to practice digital forensics as an investigator as a means to establish minimum competency requirements. What do you see the role of education playing in digital forensics? What critical success factors contribute to overall investigator competence?
It is undeniable that education plays an important role in any profession. In fact, no profession can exist without education. The basic inference from this statement is that education provides a basis and the minimum requirements with regard to the skills set for performing specific tasks related to that profession (Clarke, 2010). This is the main theme in Robert’s discussion, particularly with respect to the role of education in digital forensics. Fundamentally, I agree with the viewpoint that a license or a certification can be used to prove one’s professional competency and that education helps in ensuring that practitioners have a common skills set. An important point raised in Robert’s discussion is the fact that formal education tends to lag behind the current advances in technology and methodology, and that the impact is more profound on computer-related professions such as digital forensics wherein criminals are devising new methods. As a result, education in such dynamic disciplines needs to be more flexible to accommodate such changes in order to be relevant (Brenner, 2007).
With respect to the factor essential in ensuring investigator competence, only one main point is raised in the paper: having a mentor who can guide and correct the investigator. Perhaps, there is a need to explore other critical success factors for forensic investigators in the paper. For instance, the paper could have raised points that have a direct correlation with the forensic investigation process such as the investigator’s ability to manage, interpret and analyze forensic evidence, sequence events from the evidence, and the competency in controlling and preserving the scene. Overall, the discussion raised two important points with regard to the role of education in digital forensics: formal education is needed in licensing requirements although it has a disadvantage of lagging behind the current technological and methodological advances, and that formal education is more comprehensive than vendor-specific training courses. This ensures that practitioners have a common skills set; however, the discussion did not partake an extensive research on the critical success factors for investigator competence; perhaps, this should be the focus of the next draft.
2nd Reading Response
Student discussion (Ines): What methods and best practices should an examiner follow when approaching an investigation? What are critical success factors and ways to continually improve the investigative process?
The main objective of forensic examination is to evaluate the validity of electronic evidence in a manner that is acceptable in a court of law. The basic procedures involved in forensics examination include identification, preservation, recovery, analysis and preservation of digital evidence gathered. Achieving this objective requires an examiner to make use of the best methods and practices when undertaking an investigation (Kruse & Heiser, 2002). In this regard, Ines raises two important points for the best practices, which include recognizing the level of expertise of the police officers and the others involved in the case, and having a specialist training level 3, which entails retrieving digital evidence. The discussion also points out the key steps in approaching an investigation, which includes assessing the scope of the case followed by writing the report that documents the steps in gathering and preserving evidence. It is also imperative for a forensic investigator to make sure that the evidence is repeatable in a sense that it can be reproduced. Validating the evidence also plays an integral role in ensuring their credibility in a court of law. Other steps include creating a checklist for the case and recording the tools use. It is apparent that the discussion provided a comprehensive guide on how investigators can approach an investigation and ensure that their evidence is admissible in a court of law. Despite highlighting the core points, the discussion fails to list them in a logical order that can act as a step by step guide. For instance, there are three fundamental steps in making the collected evidence acceptable in a law court: evidence acquisition, authentication and relevance, and analysis (Newman, 2007).