Introduction

In the years since the first edition of this book, there has been an explosion of interest in digital evidence. This growth has sparked heated debates about tools, terminology, definitions, standards, ethics, and many other fundamental aspects of this developing field. It should come as no surprise that this book reflects my positions in these debates. Most notably, this text reflects my firm belief that this field must become more scientific in its approach. The primary aim of this work is to help the reader tackle the challenging process of seeking scientific truth through objective and thorough analysis of digital evidence. A desired outcome of this work is to encourage the reader to advance this field as a forensic science discipline.

Areas of Specialization

Currently, there is little clarity in this field regarding areas of specialization and who should receive what training. For instance, there is no clear distinction between digital crime scene technicians (a.k.a. first responders) and digital evidence examiners, despite the fact that data recovery requires more knowledge than basic evidence documentation, collection, and preservation. The investigative process detailed in Chapter 4 suggests three distinct groups with different levels of knowledge and training.

• Digital Crime Scene Technicians: Individuals responsible for gathering data at a crime scene should have basic training in evidence handling and documentation as well as in basic crime reconstruction to help them locate all available sources of evidence on a network.

• Digital Evidence Examiners: Individuals responsible for processing particular kinds of digital evidence require specialized training and certification in their area.

• Digital Investigators: Individuals responsible for the overall investigation should receive a general training but do not need very specialized training or certification. Investigators are also responsible for reconstructing the actions relating to a crime using information from first responders and forensic examiners to create a more complete picture for investigators and attorneys.

For the purposes of this text, the more general term "digital investigator" is used to refer to individuals who play a key role in digital investigations, including computer security professionals, attorneys, law enforcement officers and forensic examiners.

Training and certification programs in this field should take into account these different areas of expertise.