The Evolution of Computer Forensic Best Practices: An Update on Programs and Publications

Abstract

Abstract The field of computer forensics is one of the newer disciplines in the area of forensic science. Like all of the others, it is going through a transition from an art practiced by individuals to a more standardized set of techniques for which “best practices” can be defined. Over the past few years, a number of documents have been published by governmental and nonprofit groups that may well serve as de facto statements of best practices. Certainly no computer forensic professional can fail to understand that these documents may well turn up as the basis for questions in cross-examination. In this paper, we review the state of the field and identify the key documents and publications—virtually all freely available over the Internet—that are forever changing the very nature of computer forensics. This paper is based on material presented by coauthors Brill and Pollitt at the 2005 National Training Conference of the International High-Technology Crime Investigation Association. It should be noted tha...