Computer Forensics Experts, Who's Your Daddy?

In 2001, Jessica Bair was serving as an expert computer forensic examiner in a statutory rape case being prosecuted largely on the basis of digital evidence. As is common in such cases, the defense challenged the validity of the computer files by attacking the credibility of her reports and conclusions. But Bair says one thing helped tip things in her favor. When being qualified, she mentioned computer forensic certifications she had earned while in the military. As soon as she mentioned her certifications, she says the judge stopped her mid-answer and asked her to repeat each certification slowly, so he could write them down in his notes. “At the time, only military or law enforcement could get certification like this,” says Bair, who later co-created a certification program for Guidance Software. “Computer forensics examiners can have a hard time defending themselves in court without some sort of validation they can point to.”

As computer forensics has become increasingly important to civil and criminal trials, certification for computer experts has been a growing business. Today there are a handful of nonprofit and for-profit organizations that offer computer forensic certification programs. However, no one program or authority has appeared to define what a computer forensic certification should entail, which means these programs can vary wildly in terms of quality. “The fact is that most certifications in computer forensics mean little more than that the person has paid a fee and completed a form,” says Craig Ball, a computer forensics examiner in Austin, Texas. “I hold multiple certifications, so it’s not that I feel they have no value; but I think that you can pass the certification exams and still be a markedly inadequate examiner.”