- Email: [email protected]
Digital Forensic Certification Board
digital investigation 3 (2006) 7 – 8
available at www.sciencedirect.com
journal homepage: www.elsevier.com/locate/diin
Research Summary
Digital Forensic Certification Board N. Dudley-Gough* 18.139 Elsevier Advanced Technology, Reed Elsevier, Radarweg 29, 1043NX Amsterdam, The Netherlands
article info
abstract
Article history:
Nova Dudley-Gough speaks to Carrie Whitcomb about the launch of the new Digital Foren-
Received 25 January 2005
sic Certification Board ª 2006 Published by Elsevier Ltd.
Revised 26 January 2006 Accepted 26 January 2006 Keywords: Certification Forensics Professionalization of industry
Is there room for certification in an industry as fluid as computer forensics? Nova Dudley-Gough spoke to Carrie Whitcomb of the National Center for Forensic Science about the launch and development of the Digital Forensics Certification Board. As in any other industry, certification of a practitioner shows that they have a certain level of experience and specialisation in their chosen field. This is, at the basic level, endorsement of who they are and what they can do. Computer forensics is no stranger to this, as software companies and training providers have been certifying practitioners for some time. The difference is the lack of coherence – is one training course that different from another? Can an employing company trust one’s certification over another? Forensics is a field that, by its very nature, employs specialists to deal with problems that are over the hiring company’s head. How can the industry make its skills and expertise consistently clear? Carrie Whitcomb explains that the purpose behind the professional certification board is to promote confidence in the digital evidence profession. It came about after realising that a mechanism was needed to show the competencies of the * Tel.: þ31 20 485 2145. E-mail address: [email protected] 1742-2876/$ – see front matter ª 2006 Published by Elsevier Ltd. doi:10.1016/j.diin.2006.01.005
profession and that certain criteria had been met by its employees. The Board intends to examine practitioners and certify them with an internationally recognised ‘‘approved stamp’’, which has been developed with every sector of the industry. The formation committee has now been set up and features involvement from all areas of the computer and digital evidence fold: US federal agencies; academics; law enforcement (including at the US state and county levels); corporate and business, both nationally and internationally. Together these sectors will work to create questions on what are considered to be the core competencies: -
collection and preservation of evidence; forensic examination of evidence; investigative analysis; reporting on findings (written, court testimonies or otherwise).
These four elements would form the basic level of the certification, which everyone would take. More advanced
8
digital investigation 3 (2006) 7 – 8
levels, with more focused questions, would then be available to take after this first step. For example: - specific questions on the collection and preservation of information from PDAs, cellphones, global positioning systems, etc., and also on their forensic analysis; - investigative analysis of linked matters, such as international money laundering and embezzlement; - dealing with new methods of testimony and reporting – e.g. electronic courtrooms. The first stage in the process for the Board starting the certification program is the development of common
terms and vocabulary. This is being worked on by the invited industry members themselves, as the purpose of the Board is to be an organic structure that adapts with the industry. The Board does not intend to be another training body. Instead, it aims to be purely the examiner, as the training is done by the existing bodies, aiming towards the above competencies that they themselves have contributed to. The aim of the Board is, in five years’ time, to have the basic level one tests being distributed and completed in the US and Europe. And further on? To promote the professionalization of digital forensics throughout the community.
available at www.sciencedirect.com
journal homepage: www.elsevier.com/locate/diin
Research Summary
Digital Forensic Certification Board N. Dudley-Gough* 18.139 Elsevier Advanced Technology, Reed Elsevier, Radarweg 29, 1043NX Amsterdam, The Netherlands
article info
abstract
Article history:
Nova Dudley-Gough speaks to Carrie Whitcomb about the launch of the new Digital Foren-
Received 25 January 2005
sic Certification Board ª 2006 Published by Elsevier Ltd.
Revised 26 January 2006 Accepted 26 January 2006 Keywords: Certification Forensics Professionalization of industry
Is there room for certification in an industry as fluid as computer forensics? Nova Dudley-Gough spoke to Carrie Whitcomb of the National Center for Forensic Science about the launch and development of the Digital Forensics Certification Board. As in any other industry, certification of a practitioner shows that they have a certain level of experience and specialisation in their chosen field. This is, at the basic level, endorsement of who they are and what they can do. Computer forensics is no stranger to this, as software companies and training providers have been certifying practitioners for some time. The difference is the lack of coherence – is one training course that different from another? Can an employing company trust one’s certification over another? Forensics is a field that, by its very nature, employs specialists to deal with problems that are over the hiring company’s head. How can the industry make its skills and expertise consistently clear? Carrie Whitcomb explains that the purpose behind the professional certification board is to promote confidence in the digital evidence profession. It came about after realising that a mechanism was needed to show the competencies of the * Tel.: þ31 20 485 2145. E-mail address: [email protected] 1742-2876/$ – see front matter ª 2006 Published by Elsevier Ltd. doi:10.1016/j.diin.2006.01.005
profession and that certain criteria had been met by its employees. The Board intends to examine practitioners and certify them with an internationally recognised ‘‘approved stamp’’, which has been developed with every sector of the industry. The formation committee has now been set up and features involvement from all areas of the computer and digital evidence fold: US federal agencies; academics; law enforcement (including at the US state and county levels); corporate and business, both nationally and internationally. Together these sectors will work to create questions on what are considered to be the core competencies: -
collection and preservation of evidence; forensic examination of evidence; investigative analysis; reporting on findings (written, court testimonies or otherwise).
These four elements would form the basic level of the certification, which everyone would take. More advanced
8
digital investigation 3 (2006) 7 – 8
levels, with more focused questions, would then be available to take after this first step. For example: - specific questions on the collection and preservation of information from PDAs, cellphones, global positioning systems, etc., and also on their forensic analysis; - investigative analysis of linked matters, such as international money laundering and embezzlement; - dealing with new methods of testimony and reporting – e.g. electronic courtrooms. The first stage in the process for the Board starting the certification program is the development of common
terms and vocabulary. This is being worked on by the invited industry members themselves, as the purpose of the Board is to be an organic structure that adapts with the industry. The Board does not intend to be another training body. Instead, it aims to be purely the examiner, as the training is done by the existing bodies, aiming towards the above competencies that they themselves have contributed to. The aim of the Board is, in five years’ time, to have the basic level one tests being distributed and completed in the US and Europe. And further on? To promote the professionalization of digital forensics throughout the community.