Unlicensed Computer Forensics Investigators

[ccetech3]

I found this in another chat forum. This seems to be an important advisory about "Propeller Head" Investigators, as they are humorously called sometimes.

"Those of you in the legal or investigation field have probably used or have been up against the unlicensed computer forensic expert, examiner, investigator, or whatever they label themselves. Often the testimony and cross-examinations are difficult and expensive!

There can be a short cut to challenging the Unlicensed Computer Foreniscs Investigative Expert. The challenge should be done early in the case. Check the expert's investigative behavior. You will find many of these experts are just computer technicians with histories of doing criminal and civil case investigations under the wrong and illegal assumption that since their investigation involves computer evidence then no licensing is required.

They examine computers for evidence secured from their out-in-the-field investigation or the client provides them with the computer in order to find digital evidence and further leads. You will find them following-up and investigating those leads. When professionally questioned under oath most fold, become evasive and claim "special status" and exemption from the law. When the other side's client or attorney is advised it is not uncommon to discover this issue was not disclosed and was known by the unlicensed computer forensics investigator at time of hiring. Some of their resumes are quite impressive with many claims of "certifications" that amount to private sector "high tech" investigation training programs that they completed.

Most states have solid and current licensing law that can be cited and used to eliminate the unlicensed investigator from the case. Check your state investigator licensing laws. If the unlicensed computer forensics investigator is from another state, and has entered your state without authorization, and without further licensing then you could have further cause for removal.

If you find one that makes the excuse that he has already qualified in court on previous cases, just make sure he knows that he did not get caught then, and qualifying in court does not magically produce an investigator's license.

If you have hired one, and do not know about this issue, question the unlicensed computer forensics investigator closely, on qualifications, criminal backgrounds, licensing at all levels, and business tax exemption claims.

If you want further details on "Challenging the Unlicensed Professional" send me an E-mail request. Your clients deserve the best, and removing an unlicensed investigator from the "other side's" case is to their benefit.

conrado50@comcast.net"

[infosecwriter]

ccetech3, you quoted a post from ccetech. Interesting that the names are so close together. - http://www.lawguru.com/forums/index.php?showtopic=190

ìqualifying in court does not magically produce an investigator's license.î

There is no such thing as a computer investigator license. Someone on the Internet claimed to be a "Licensed Computer Forensic Private Investigator" in the state of California, but that claim was untrue. The person was only a PI claiming the fabricated license.

ìMost states have solid and current licensing law that can be cited and used to eliminate the unlicensed investigator from the case.î

Name each one and the corresponding sentences that can be ìcitedî. I'm calling you out on this statement. Using the word ìMostî is untrue and an outright lie. For example; throughout the Midwest, the states do not have such requirementsÖ Computer forensics is not part of the PI "roles and responsibilities". Iíve asked the licensing boards. So, with all the talk about having testimony thrown out, how are false statements looked at in court?

ìSome of their resumes are quite impressive with many claims of "certifications" that amount to private sector "high tech" investigation training programs that they completed.î

Are you so negative against computer experts because you canít pass the exams? They are far harder then the PI exams because they expect hands on experience and detailed knowledge of the subject matter. Most are not passable just by going through a training program. CCIE, CISSP, LPTÖ I doubt you could pass the ìmajorityî of them without years of hands on experience in several domains of knowledge

Iím willing to state that you donít understand computer forensics as a profession and the entire scope that it entails. This means more then just acquisitioning the hard drive and running EnCase to find pictures. I mean knowing what the data actually means. Knowing how networking really works and how criminal hackers really think.

It is great that there are people out there trying to standardize the profession. There are several trolls out there on the internet that are NOT qualified in network engineering, database administration, software design, system architecture, and penetration testing. These unqualified ìlicensedî investigators like to use the phrase ìunlicensed computer forensics investigatorî as a hot keyword to hide their own inadequacies and in many cases, incompetence.
---

If you want further details on "Spotting an unqualified computer forensic PI" send me an E-mail request. Your clients deserve the best, and removing an unqualified PI from case is to their benefit.

infosecwriter@gmail.com