Greg, I edited out most of my original reply. I was in danger of letting my passion for the subject get carried away….
Andy
And while I agree that the 'smelling out the rat' scenario can often be better accomplished by an experienced law enforcement official, the fact remains, IMO, that years of training in computer systems cannot be 'replaced' by good detective work. Understanding technology at the level we are required to work is not, and cannot be gained in a short while, and can often be better accomplished by one who has spent the years in that field.
I agree with everything you have said in the quote above. I certainly don't think that one replaces the other. The challenge for Law Enforcement is to gain that technical knowledge. The challenge for IT is to move away from the black and white world of bytes and bits and develop creative problem solving (putting the puzzle together without knowing how many pieces are there). You are especially correct in stating that this cannot be learned overnight.
I don't take offense to what you said in your initial post, I just think it is wrong. I have been given a great deal of assistance from LE examiner's in the UK over the years, and I feel in a good position to state that they are very good at what they do. Very capable of discussing the why and the how. I think that there is good proof of that on this forum.
I'm by no means any expert nor do I think that there is a definitive answer to this question but as Andy felt the need to defend the LE position i'd also like to toss in that I think the corporate incident response professional wouldn't be very good if she/he was stuck in the "black and white world of bytes and bits" most incident response / techincal information security professionals (penetration testers/ intrusion analysts/ researchers) are good in their positions because they have the ability to "think outside of the box" and are great at detecting patterns and correlating anomalies. So I certainly don't think we lack the skill to put together the pieces of the puzzle when compared with say, a person with an investigative background
–Ty
I think it’s only fair that you name the police forces in question. As I have friends and colleagues in most of the 43 Forces throughout the UK, and I am sure they would like to know what a representative of the Brody Organisation is saying about them. I have a feeling they may want to address it.
Some of the UK's leading experts in Forensic Computing are or have been police officers. I don't like to use others as example, but on this occasion I feel I must - take for example Craig Wilson, try posting on his bbs and see what reception you get. Craig is the author or NetAnalysis (a forensic tool for examiantion of internet history).
I have had police officers tell me the same story.
Were they members of a High Tech Crime or Computer Investigation Unit? I doubt it very much. I think you need to be specific.
I know many of the UK's Forensic Computing examiners/investigators, having been a member of F3 for some time now, (are you a member of F3?) attending conferences and courses I have got to know many, and can say you are very much mistaken (many of whom are civilian support staff/employees - so its not all police officers you are targeting). Also I attended a course at the regional computer forensic labs, FBI Chicago, and can vouch that our US colleagues are very competent.
. Understanding technology at the level we are required to work is not, and cannot be gained in a short while, and can often be better accomplished by one who has spent the years in that field
Agreed, but most of the examiners I know have indeed spent years in this field and had occupation in I.T. prior to joing the police (as officers or support staff). Most have developed skills in FC over a long period of time. Most have completed intense courses at MSc level at RMSC Cranfield.
This is indeed a forum "a place to air and discuss"; however your remarks are divisive, and I suspect designed to as a marketing strategy for your business.
Andy
Well Jon, I’m sorry your upset about my ‘sweeping statements’ but the words pot calling kettle black spring to mind.
most of them have only the basic training and not the years of experience that most of the propellor heads in the private sector have
It's a shame you will not be returning as I am sure you would eventually provide a valuable contrabution to the forum.
Andy
Just a quick note to explain the missing posts from this thread. DrJon has asked for his account to be removed and I'm afraid the CMS doesn't handle threads with posts from deleted users very well at the moment so I've had to delete his posts too. This issue will be addressed in the future, though.
Kind regards,
Jamie
I would also point out that LE Forensic computer examiners not only have the job of finding and presenting data from computers that are seized during enquiries (a hard enough job in itself) but also have a need during the course of these examinations to be aware of a vast array of legal aspects such as statutory defences, intelligence aspects, human rights issues as to where they look, admissability, what is evidence of that enquiry and what may be evidence of other unknown offences etc etc etc, need i go one.
In our unit apart from getting data from computers relating to the offences being investigated we have also recovered various other artifacts and details that have actually led to the identification and tracing of kids that were being abused by adults and those kids being for want of a better word rescued and the adults responsible arrested. these kids are from not only the UK but in our case America and Germany
So whilst I agree that LE may not have the technical backgrounds of some of the private sector I object (like Andy seems to do) when derogatory comments are made. At the end of the day everybody on this forum is doing the best they can so can we all give each other the respect we all deserve
Sorry it has been so long winded i got a bit carried away with myself