Presentation on theme: "QUALIFYING DIGITAL FORENSIC PRACTITIONERS AS EXPERT WITNESSES IN SOUTH AFRICAN COURTS Lex Informatica Conference 25 th September 2014."— Presentation transcript:
QUALIFYING DIGITAL FORENSIC PRACTITIONERS AS EXPERT WITNESSES IN SOUTH AFRICAN COURTS Lex Informatica Conference 25 th September 2014
FORENSIC SCIENCE EXPERTS The role of forensic scientists in court continues to grow and they can play a valuable role in cases As forensic scientists they are supposed to be first an foremost scientists bound by prescribed minimum scientific standards Digital forensics is an accepted forensic science discipline and as such its practitioners need to meet minimum scientific standards as well
DIGITAL FORENSIC STANDARDS SWGDE ASTM NIST ISO UNODC FEPAC FSS ENFSI
MINIMUM ACCEPTABLE ACADEMIC STANDARDS A minimum of a Bachelors degree in Computer Science or Computer Engineering, or a Bachelors degree in Digital Forensic meeting either FEPAC or FSS standards A Masters degree in Computer Science with a focus of digital forensics, or a Masters degree in digital forensics meeting either FEPAC or FSS standards, is a strong recommendation
ACADEMIC QUALIFICATION COMPLIANCE IN SOUTH AFRICA
MINIMUM TECHNICAL QUALIFICATION Formal technical training in the field of digital forensics A general digital forensics certification which requires regular proficiency testing and the maintenance of continuing professional education Specific technical and tool certifications are recommended
ASKING THE RIGHT QUESTIONS Exactly what tools did you use, and do you know what there strengths and limitations are? Where did the tools locate the evidence and how do they parse out the data? What was the files system used on the media? Can you explain how this file system is structured? Can you explain the different between sectors and clusters? Can you explain how email works? Can you explain how an Internet browser works? Can you explain TP/IP? Can you explain the mathematical processes involved in hashing?