QUALIFYING DIGITAL FORENSIC PRACTITIONERS AS EXPERT WITNESSES IN SOUTH AFRICAN COURTS Lex Informatica Conference 25 th September 2014

FORENSIC SCIENCE EXPERTS  The role of forensic scientists in court continues to grow and they can play a valuable role in cases  As forensic scientists they are supposed to be first an foremost scientists bound by prescribed minimum scientific standards  Digital forensics is an accepted forensic science discipline and as such its practitioners need to meet minimum scientific standards as well

DIGITAL FORENSIC STANDARDS  SWGDE  ASTM  NIST  ISO  UNODC  FEPAC  FSS  ENFSI

MINIMUM ACCEPTABLE ACADEMIC STANDARDS  A minimum of a Bachelors degree in Computer Science or Computer Engineering, or a Bachelors degree in Digital Forensic meeting either FEPAC or FSS standards  A Masters degree in Computer Science with a focus of digital forensics, or a Masters degree in digital forensics meeting either FEPAC or FSS standards, is a strong recommendation

ACADEMIC QUALIFICATION COMPLIANCE IN SOUTH AFRICA

MINIMUM TECHNICAL QUALIFICATION  Formal technical training in the field of digital forensics  A general digital forensics certification which requires regular proficiency testing and the maintenance of continuing professional education  Specific technical and tool certifications are recommended

TRAINING COMPLIANCE IN SOUTH AFRICA

ASKING THE RIGHT QUESTIONS  Exactly what tools did you use, and do you know what there strengths and limitations are?  Where did the tools locate the evidence and how do they parse out the data?  What was the files system used on the media? Can you explain how this file system is structured?  Can you explain the different between sectors and clusters?  Can you explain how works?  Can you explain how an Internet browser works?  Can you explain TP/IP?  Can you explain the mathematical processes involved in hashing?

OPEN DISCUSSION

THANK YOU Jason Jordaan CFCE, CFE, PMIITPSA, GCFE MSc, MTech, BComHons, BSc, BTech Principal Forensic Scientist