QUALIFYING DIGITAL FORENSIC
PRACTITIONERS AS EXPERT
WITNESSES IN SOUTH AFRICAN
COURTS
Lex Informatica Conference
25th September 2014
The role of forensic scientists in court continues
to grow and they can play a valuable role in
cases
FORENSIC
SCIENCE
EXPERTS
As forensic scientists they are supposed to be
first an foremost scientists bound by prescribed
minimum scientific standards
Digital forensics is an accepted forensic science
discipline and as such its practitioners need to
meet minimum scientific standards as well
SWGDE
ASTM
DIGITAL
FORENSIC
STANDARDS
NIST
ISO
UNODC
FEPAC
FSS
ENFSI
MINIMUM
ACCEPTABLE
ACADEMIC
STANDARDS
A minimum of a Bachelors degree in Computer Science
or Computer Engineering, or a Bachelors degree in
Digital Forensic meeting either FEPAC or FSS
standards
A Masters degree in Computer Science with a focus of
digital forensics, or a Masters degree in digital forensics
meeting either FEPAC or FSS standards, is a strong
recommendation
9%
ACADEMIC
QUALIFICATION
COMPLIANCE
IN SOUTH
AFRICA
Yes
No
91%
Formal technical training in the field of digital forensics
MINIMUM
TECHNICAL
QUALIFICATION
A general digital forensics certification which requires
regular proficiency testing and the maintenance of
continuing professional education
Specific technical and tool certifications are
recommended
9%
TRAINING
COMPLIANCE
IN SOUTH
AFRICA
Yes
No
91%
Exactly what tools did you use, and do you know what there
strengths and limitations are?
Where did the tools locate the evidence and how do they parse
out the data?
ASKING THE
RIGHT
QUESTIONS
What was the files system used on the media? Can you explain
how this file system is structured?
Can you explain the different between sectors and clusters?
Can you explain how email works?
Can you explain how an Internet browser works?
Can you explain TP/IP?
Can you explain the mathematical processes involved in hashing?
OPEN
DISCUSSION
Jason Jordaan
CFCE, CFE, PMIITPSA, GCFE
THANK YOU
MSc, MTech, BComHons, BSc, BTech
Principal Forensic Scientist
jason@dfirlabs.com
0
