Organizations are often faced with maintaining their policies and complying with laws relating to the storage, retrieval, and securing of electronic data. Technology professionals can use some of the same tools that law enforcement uses to help their organizations investigate: policy violations, electronic tampering, theft, and the inappropriate use of email, the Internet, or company-owned technology. While these violations are not usually of a criminal nature, the findings may result in disciplinary action or termination. Technical professionals must be able to verify and accurately document their findings. A solid understanding of computer forensic processes and documentation is vital to successfully addressing these issues.
Computer forensics training provides a framework for conducting computer-based investigations. Who has the legal right to access a computer, network, or digital media for the purpose of recovering data or information for potential use in legal matters (computer forensics) or to enforce policy? Training covers the use of forensic software on a hard drives, thumb drives, cell phones or in Random Access Memory (RAM). Computer forensics education includes a discussion of relevant laws. Training is usually provided on the use of software for maintaining log files, pin traps, video surveillance, cracking passwords, and sniffers or key loggers.
Increasingly, computer forensic investigative techniques are employed by law enforcement, businesses, information technology professionals, and individuals to support criminal case development, employee termination or discipline for policy violations, and family law cases. Demand for computer forensic specialists is high. Since computer forensics is a relatively new field, legal and ethical issues may not be well-defined. This is an especially tricky area for the information technology professional who may be required to perform these investigations without the benefit of having specialized training in computer forensics.
