Picon
Gravatar

[OT] Getting into forensic work

I _must_ be misunderstading the requirements of all of this, because I
simply cannot believe that what I am finding could at all be accurate
for the things that I want to do.

The reason I am sending this here is because I know that there are
people here familiar with the process, though I apologize for the mostly
off-topic nature.  Though if it helps, I plan on doing the work with
Linux!  :-P

Anyway, I want to have the ability to perform analyses that may be
court-bound.  My understanding is that in GA, this requires some form of
licensing.  That's fine, and I'm willing to get a license, but the only
thing I can find says I need to have a four year degree in criminal
justice and two years experience as a law enforcement officer or a
person in charge of things at a company that is so licensed.  Really?
Even though I already know how to do things like preserve things and
ensure that they're sound, I can't just pass an exam or something?

Is getting a company bootstrapped for this really that much of an
ordeal?  Just to be allowed to say "yes, I was able to find data items
X, Y and Z on drive AA, and this is the procedure used to make it a
forensically sound process" in a court?

	--- Mike

--

-- 
A man who reasons deliberately, manages it better after studying Logic
than he could before, if he is sincere about it and has common sense.
                                   --- Carveth Read, “Logic”

(Continue reading)

Greg Clifton | 10 Jul 2012 18:36
Picon

Re: [OT] Getting into forensic work

Mike,


Greg Freeman is your go to guy for this sort of stuff. He has been doing exactly that sort of stuff for several years. Besides the technical competence, which you no doubt have, there is the legal aspect of chain of custody and such. To be admissible in court, it must be able to be proven that the evidence has not been altered in any way. Perhaps the experience requirement is to demonstrate not so much competence as a test of character to show that you aren't tempted to mishandle the evidence? 

Best to you,
Greg Clifton

On Tue, Jul 10, 2012 at 12:17 PM, mike-cRPrJ27hGUicqzYg7KEe8g@public.gmane.org <mike-cRPrJ27hGUicqzYg7KEe8g@public.gmane.org> wrote:
I _must_ be misunderstading the requirements of all of this, because I
simply cannot believe that what I am finding could at all be accurate
for the things that I want to do.

The reason I am sending this here is because I know that there are
people here familiar with the process, though I apologize for the mostly
off-topic nature.  Though if it helps, I plan on doing the work with
Linux!  :-P

Anyway, I want to have the ability to perform analyses that may be
court-bound.  My understanding is that in GA, this requires some form of
licensing.  That's fine, and I'm willing to get a license, but the only
thing I can find says I need to have a four year degree in criminal
justice and two years experience as a law enforcement officer or a
person in charge of things at a company that is so licensed.  Really?
Even though I already know how to do things like preserve things and
ensure that they're sound, I can't just pass an exam or something?

Is getting a company bootstrapped for this really that much of an
ordeal?  Just to be allowed to say "yes, I was able to find data items
X, Y and Z on drive AA, and this is the procedure used to make it a
forensically sound process" in a court?

        --- Mike

--
A man who reasons deliberately, manages it better after studying Logic
than he could before, if he is sincere about it and has common sense.
                                   --- Carveth Read, “Logic”



_______________________________________________
Ale mailing list
Ale-S6NtOCTnm14@public.gmane.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo


_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo
Picon
Gravatar

Re: [OT] Getting into forensic work

On 07/10/2012 12:36 PM, Greg Clifton wrote:
> Greg Freeman is your go to guy for this sort of stuff. He has been doing
> exactly that sort of stuff for several years. Besides the technical
> competence, which you no doubt have, there is the legal aspect of chain
> of custody and such. To be admissible in court, it must be able to be
> proven that the evidence has not been altered in any way. Perhaps the
> experience requirement is to demonstrate not so much competence as a
> test of character to show that you aren't tempted to mishandle the
> evidence? 

I guess, but it'd seem to me that the $25k bond would be enough to do
that for the average Joe...

If the barrier to entry is as high as I think it is, though, it makes my
job practically useless.  It'd mean that before doing anything I'd have
to ensure that I have a contractor available that is so licensed, and
what about the situation where I am working on something and then
realize that I need to collect data and such in this way?  Then I have
to stop and call someone else---which is not only very expensive, but my
hands have then provided "taint" because I don't have "credential".

Sigh.

	--- Mike

--

-- 
A man who reasons deliberately, manages it better after studying Logic
than he could before, if he is sincere about it and has common sense.
                                   --- Carveth Read, “Logic”

_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo
JD | 10 Jul 2012 19:30
Favicon

Re: [OT] Getting into forensic work

On 07/10/2012 12:17 PM, mike@... wrote:
> I _must_ be misunderstading the requirements of all of this, because I
> simply cannot believe that what I am finding could at all be accurate
> for the things that I want to do.

The DC404 http://dc404.org/ guys might be able to help.  I thought that some
states actually require a PI license, but that GA did not.  Google found this
detailed article
http://www.knfcon.com/newsroom/archive/do-digital-experts-need-pi-license.html ,
which you've probably already seen.

>From another perspective, shouldn't an expert witness in a court require some
formal training plus relevant experience in proper methods?  Looks like the
shortest distance for you is to be hired by an existing company, work their for
2 years in the correct department, then figure out how to start you own
business.  Unless I've read something wrong.
_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

Michael Trausch | 10 Jul 2012 19:34
Picon
Gravatar

Re: [OT] Getting into forensic work

Nah, I would expect the judge to determine and expert witness' competence on his/her own merits. Credentials prove little for most types of credential, especially when talking about computers generally. Just because someone has a license to practice forensics doesn't mean they will act appropriately, but it does mean that they will be believed when they claim that they have done so.

On Jul 10, 2012 1:30 PM, "JD" <jdp-iBetQU9TKP1Wk0Htik3J/w@public.gmane.org> wrote:
On 07/10/2012 12:17 PM, mike-cRPrJ27hGUicqzYg7KEe8g@public.gmane.org wrote:
> I _must_ be misunderstading the requirements of all of this, because I
> simply cannot believe that what I am finding could at all be accurate
> for the things that I want to do.

The DC404 http://dc404.org/ guys might be able to help.  I thought that some
states actually require a PI license, but that GA did not.  Google found this
detailed article
http://www.knfcon.com/newsroom/archive/do-digital-experts-need-pi-license.html ,
which you've probably already seen.

>From another perspective, shouldn't an expert witness in a court require some
formal training plus relevant experience in proper methods?  Looks like the
shortest distance for you is to be hired by an existing company, work their for
2 years in the correct department, then figure out how to start you own
business.  Unless I've read something wrong.
_______________________________________________
Ale mailing list
Ale-S6NtOCTnm14@public.gmane.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo
_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo
Michael Trausch | 10 Jul 2012 19:38
Picon
Gravatar

Re: [OT] Getting into forensic work

To be a bit better about it: a credential, used in a court case, is seen as satisfactory proof of competency. I think that is probably a bad idea as it only proves that the person passed as competent at some point in the past. A person should have to actually prove their competence on a case-by-case basis, instead of the judge telling the jury that a credential is proof positive itself. Just my two cents, though.

On Jul 10, 2012 1:34 PM, "Michael Trausch" <mike-cRPrJ27hGUicqzYg7KEe8g@public.gmane.org> wrote:

Nah, I would expect the judge to determine and expert witness' competence on his/her own merits. Credentials prove little for most types of credential, especially when talking about computers generally. Just because someone has a license to practice forensics doesn't mean they will act appropriately, but it does mean that they will be believed when they claim that they have done so.

On Jul 10, 2012 1:30 PM, "JD" <jdp-iBetQU9TKP1Wk0Htik3J/w@public.gmane.org> wrote:
On 07/10/2012 12:17 PM, mike-cRPrJ27hGUicqzYg7KEe8g@public.gmane.org wrote:
> I _must_ be misunderstading the requirements of all of this, because I
> simply cannot believe that what I am finding could at all be accurate
> for the things that I want to do.

The DC404 http://dc404.org/ guys might be able to help.  I thought that some
states actually require a PI license, but that GA did not.  Google found this
detailed article
http://www.knfcon.com/newsroom/archive/do-digital-experts-need-pi-license.html ,
which you've probably already seen.

>From another perspective, shouldn't an expert witness in a court require some
formal training plus relevant experience in proper methods?  Looks like the
shortest distance for you is to be hired by an existing company, work their for
2 years in the correct department, then figure out how to start you own
business.  Unless I've read something wrong.
_______________________________________________
Ale mailing list
Ale-S6NtOCTnm14@public.gmane.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo
_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo
Jim Lynch | 11 Jul 2012 01:47
Favicon

Re: [OT] Getting into forensic work

On 07/10/2012 01:38 PM, Michael Trausch wrote:
> To be a bit better about it: a credential, used in a court case, is 
> seen as satisfactory proof of competency. I think that is probably a 
> bad idea as it only proves that the person passed as competent at some 
> point in the past. A person should have to actually prove their 
> competence on a case-by-case basis, instead of the judge telling the 
> jury that a credential is proof positive itself. Just my two cents, 
> though. 
Where on earth did you get the idea that the practice of law involves  
reason? ;-)

Jim.

_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

gcs8 | 11 Jul 2012 02:01
Picon

Re: [OT] Getting into forensic work

talk to Scott Moulton.

On Tue, Jul 10, 2012 at 7:47 PM, Jim Lynch <ale_nospam-KHNjTddzxjXm3cQGBu7GGdBPR1lH4CV8@public.gmane.org> wrote:
On 07/10/2012 01:38 PM, Michael Trausch wrote:
> To be a bit better about it: a credential, used in a court case, is
> seen as satisfactory proof of competency. I think that is probably a
> bad idea as it only proves that the person passed as competent at some
> point in the past. A person should have to actually prove their
> competence on a case-by-case basis, instead of the judge telling the
> jury that a credential is proof positive itself. Just my two cents,
> though.
Where on earth did you get the idea that the practice of law involves
reason? ;-)


Jim.

_______________________________________________
Ale mailing list
Ale-S6NtOCTnm14@public.gmane.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo



--
Charles Selfridge

PBYC  IT director

(404) 910-3409

_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo
Ted W | 11 Jul 2012 03:04

Re: [OT] Getting into forensic work


On Jul 10, 2012, at 8:01 PM, gcs8 wrote:
talk to Scott Moulton.

On Tue, Jul 10, 2012 at 7:47 PM, Jim Lynch <ale_nospam-KHNjTddzxjXm3cQGBu7GGdBPR1lH4CV8@public.gmane.org> wrote:
On 07/10/2012 01:38 PM, Michael Trausch wrote:
> To be a bit better about it: a credential, used in a court case, is
> seen as satisfactory proof of competency. I think that is probably a
> bad idea as it only proves that the person passed as competent at some
> point in the past. A person should have to actually prove their
> competence on a case-by-case basis, instead of the judge telling the
> jury that a credential is proof positive itself. Just my two cents,
> though.
Where on earth did you get the idea that the practice of law involves
reason? ;-)


Jim.

_______________________________________________
Ale mailing list
Ale-S6NtOCTnm14@public.gmane.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo



--
Charles Selfridge

PBYC  IT director

(404) 910-3409

_______________________________________________
Ale mailing list
Ale-S6NtOCTnm14@public.gmane.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

+1, I was just about to suggest the same guy. I believe he's local as well.
-- 
Ted W. < Ted-5kh5vjNAXU8nDTDN1yNbJA@public.gmane.org >
Registered GNU/Linux user #413569



_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo
gcs8 | 11 Jul 2012 03:28
Picon

Re: [OT] Getting into forensic work

He is, he is also a great guy and very on top of things.

from gcs8's mobile device.

On Jul 10, 2012 9:05 PM, "Ted W" <ted-pukp/ifawS0nDTDN1yNbJA@public.gmane.org> wrote:

On Jul 10, 2012, at 8:01 PM, gcs8 wrote:
talk to Scott Moulton.

On Tue, Jul 10, 2012 at 7:47 PM, Jim Lynch <ale_nospam-KHNjTddzxjXm3cQGBu7GGdBPR1lH4CV8@public.gmane.org> wrote:
On 07/10/2012 01:38 PM, Michael Trausch wrote:
> To be a bit better about it: a credential, used in a court case, is
> seen as satisfactory proof of competency. I think that is probably a
> bad idea as it only proves that the person passed as competent at some
> point in the past. A person should have to actually prove their
> competence on a case-by-case basis, instead of the judge telling the
> jury that a credential is proof positive itself. Just my two cents,
> though.
Where on earth did you get the idea that the practice of law involves
reason? ;-)


Jim.

_______________________________________________
Ale mailing list
Ale-S6NtOCTnm14@public.gmane.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo



--
Charles Selfridge

PBYC  IT director


_______________________________________________
Ale mailing list
Ale-S6NtOCTnm14@public.gmane.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

+1, I was just about to suggest the same guy. I believe he's local as well.
-- 
Ted W. < Ted-5kh5vjNAXU8nDTDN1yNbJA@public.gmane.org >
Registered GNU/Linux user #413569




_______________________________________________
Ale mailing list
Ale-S6NtOCTnm14@public.gmane.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo
Wolf Halton | 11 Jul 2012 03:33
Picon
Gravatar

Re: [OT] Getting into forensic work

Scott mouton is local. I was trying to get a private investigator instructor to help me get a PI license so i could do legal pen testing in GA. The PI lobby is strong in GA and got the legislature to pass a law that any criminal investigation had to be by licensed private investigators.  There are only about 200 PI firms in GA, so they don't really know what they can do with all the forensic discovery and pen testing. Mostly this means a number of security experts are flying under the radar. Any lawyer could get sworn expert testimony thrown out on this technicality. 
It makes as much sense as requiring a stockbroker to have a plumber's license.

Wolf

http://evergreen-community-01.lyrasistechnology.org
http://sourcefreedom.com
Apache developer:
wolfhalton-1oDqGaOF3Lkdnm+yROfE0A@public.gmane.org

On Jul 10, 2012 9:05 PM, "Ted W" <ted-pukp/ifawS0nDTDN1yNbJA@public.gmane.org> wrote:

On Jul 10, 2012, at 8:01 PM, gcs8 wrote:
talk to Scott Moulton.

On Tue, Jul 10, 2012 at 7:47 PM, Jim Lynch <ale_nospam-KHNjTddzxjXm3cQGBu7GGdBPR1lH4CV8@public.gmane.org> wrote:
On 07/10/2012 01:38 PM, Michael Trausch wrote:
> To be a bit better about it: a credential, used in a court case, is
> seen as satisfactory proof of competency. I think that is probably a
> bad idea as it only proves that the person passed as competent at some
> point in the past. A person should have to actually prove their
> competence on a case-by-case basis, instead of the judge telling the
> jury that a credential is proof positive itself. Just my two cents,
> though.
Where on earth did you get the idea that the practice of law involves
reason? ;-)


Jim.

_______________________________________________
Ale mailing list
Ale-S6NtOCTnm14@public.gmane.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo



--
Charles Selfridge

PBYC  IT director


_______________________________________________
Ale mailing list
Ale-S6NtOCTnm14@public.gmane.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

+1, I was just about to suggest the same guy. I believe he's local as well.
-- 
Ted W. < Ted-5kh5vjNAXU8nDTDN1yNbJA@public.gmane.org >
Registered GNU/Linux user #413569




_______________________________________________
Ale mailing list
Ale-S6NtOCTnm14@public.gmane.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo
Matthew | 11 Jul 2012 13:59
Picon

Re: [OT] Getting into forensic work

same person I was going to suggest, We all know the same circles.


On Tue, Jul 10, 2012 at 9:33 PM, Wolf Halton <wolf.halton-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:

Scott mouton is local. I was trying to get a private investigator instructor to help me get a PI license so i could do legal pen testing in GA. The PI lobby is strong in GA and got the legislature to pass a law that any criminal investigation had to be by licensed private investigators.  There are only about 200 PI firms in GA, so they don't really know what they can do with all the forensic discovery and pen testing. Mostly this means a number of security experts are flying under the radar. Any lawyer could get sworn expert testimony thrown out on this technicality. 
It makes as much sense as requiring a stockbroker to have a plumber's license.

Wolf

http://evergreen-community-01.lyrasistechnology.org
http://sourcefreedom.com
Apache developer:
wolfhalton <at> apache.org

On Jul 10, 2012 9:05 PM, "Ted W" <ted-pukp/ifawS0nDTDN1yNbJA@public.gmane.org> wrote:

On Jul 10, 2012, at 8:01 PM, gcs8 wrote:
talk to Scott Moulton.

On Tue, Jul 10, 2012 at 7:47 PM, Jim Lynch <ale_nospam-KHNjTddzxjXm3cQGBu7GGdBPR1lH4CV8@public.gmane.org> wrote:
On 07/10/2012 01:38 PM, Michael Trausch wrote:
> To be a bit better about it: a credential, used in a court case, is
> seen as satisfactory proof of competency. I think that is probably a
> bad idea as it only proves that the person passed as competent at some
> point in the past. A person should have to actually prove their
> competence on a case-by-case basis, instead of the judge telling the
> jury that a credential is proof positive itself. Just my two cents,
> though.
Where on earth did you get the idea that the practice of law involves
reason? ;-)


Jim.

_______________________________________________
Ale mailing list
Ale-S6NtOCTnm14@public.gmane.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo



--
Charles Selfridge

PBYC  IT director


_______________________________________________
Ale mailing list
Ale-S6NtOCTnm14@public.gmane.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

+1, I was just about to suggest the same guy. I believe he's local as well.
-- 
Ted W. < Ted-5kh5vjNAXU8nDTDN1yNbJA@public.gmane.org >
Registered GNU/Linux user #413569




_______________________________________________
Ale mailing list
Ale-S6NtOCTnm14@public.gmane.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo


_______________________________________________
Ale mailing list
Ale-S6NtOCTnm14@public.gmane.org
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo




--
SimonTek
912-398-6704

_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo
Jeff Hubbs | 10 Jul 2012 19:52
Picon
Favicon

Re: [OT] Getting into forensic work

My recollection was that in GA, you needed a private investigator's license, whatever that entails.  You can imagine that there's going to be a barrier to entry there - it can be lucrative work (albeit one that entails a lot of waiting around, which, one hopes, is billable) and any shmoe with a liveCD can conceivably handle light requirements.

On 7/10/12 12:17 PM, mike-cRPrJ27hGUicqzYg7KEe8g@public.gmane.org wrote:
I _must_ be misunderstading the requirements of all of this, because I simply cannot believe that what I am finding could at all be accurate for the things that I want to do. The reason I am sending this here is because I know that there are people here familiar with the process, though I apologize for the mostly off-topic nature. Though if it helps, I plan on doing the work with Linux! :-P Anyway, I want to have the ability to perform analyses that may be court-bound. My understanding is that in GA, this requires some form of licensing. That's fine, and I'm willing to get a license, but the only thing I can find says I need to have a four year degree in criminal justice and two years experience as a law enforcement officer or a person in charge of things at a company that is so licensed. Really? Even though I already know how to do things like preserve things and ensure that they're sound, I can't just pass an exam or something? Is getting a company bootstrapped for this really that much of an ordeal? Just to be allowed to say "yes, I was able to find data items X, Y and Z on drive AA, and this is the procedure used to make it a forensically sound process" in a court? --- Mike

_______________________________________________ Ale mailing list Ale-S6NtOCTnm14@public.gmane.org http://mail.ale.org/mailman/listinfo/ale See JOBS, ANNOUNCE and SCHOOLS lists at http://mail.ale.org/mailman/listinfo


_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

Gmane