by Nick Furneaux
CSITech
www.csitech.co.uk

For many years if someone asked what I did for a living I would have to use an all-purpose description such as I worked in computer security or even worse I would just mumble 'computers'. Now, if I say computer forensics, they say, 'Oh, like on CSI [a popular TV show], what colour is your Humvee?' For the first time last month I was asked by someone (who just about knew how to pick up email) how they could get into my line of work, and this both worried and interested me at the same time.

Searching the forums I find many basic questions by those looking to get into the 'industry' or even more worryingly asking, 'I'm just setting up my own business, how do you image a hard drive?' Is this new trend a good thing or bad thing for our 'art'?

It was not until I really stopped and thought about not only the complexities of electronic forensics but the consequences of getting it wrong that I became concerned. Can we even begin to imagine the miscarriages of justice that would happen if electronic forensic investigation became the new web design? Just about anyone with a good grounding in computing can stumble their way around EnCase or FTK, but knowing what the buttons do does not make a good investigator. So much more knowledge is needed along with a certain mind-set that takes an investigator in a particular direction or enables them to 'see' a line of reasoning or follow a hunch generated through experience.

On the flip side, the industry, both in law enforcement and the private sector needs new blood, young computer engineers that do understand the new technologies and how people use the Internet today. How can we both attract them and yet control the flow of people to ensure a certain level of competency and protection?

My problem is that I can't remember when I started in forensics. Although I have been involved with computer security in the corporate sector for a decade I am unable to remember my first investigative toe in the water. I think it was to do with an employee who was deliberately deleting key company files. I certainly remember flying to a meeting on the subject in the Physics Department of The University of Florida back in 1998 and have since worked in the UK, USA and Russia; but does that history make me an expert, a specialist? How can a defence team or a corporate IT department who pay for my services be sure that I know what I am doing?

The industry needs an International Controlling Body and even an industry qualification as is now appearing for computer security. In the UK, to be 'approved' by any of the official or even self-appointed directories of Expert Witnesses you just need to supply proof of work done for two law firms; that's it! Great isn't it? I was recently approached by a law firm that had received a marketing email from my company who retained me to defend an indecent images case. They handed over all the case notes and made an appointment for me to go to the police and gain access to 3 CDs worth of illegal images and they did this all without checking who I was. This cannot be allowed to continue.