Monday, April 19, 2010

Survey: ACPO Good Practice Guide for Computer-Based Electronic Evidence

An editorial panel is currently reviewing the ACPO Good Practice Guide for Computer-Based Electronic Evidence and is seeking the views of interested parties from both the law enforcement and private community of users and service providers, the IT sector, and academia . The panel's remit is to update the content to ensure it is current and relevant, and to see if there is any area of digital forensics not included in the guide that would benefit from inclusion. Participants are asked to complete a survey at and submit their views.

Wednesday, April 07, 2010

Neutral examiners

by Craig Ball

Craig Ball
About the Author

Craig Ball is a Texas lawyer who limits his practice to service as a court-appointed special master and consultant in computer forensics and electronic discovery.

I recently posted an open letter to judges on a blog that caters to an e-discovery audience. I asked judges to stop ordering parties to turn over their systems to the opposing side's computer forensic examiners and argued that most civil forensics work should be reserved to neutral examiners.

Now, while you rush to warm the tar and pluck the feathers, please hear me out.

Yes, most of my work as a computer forensic examiner is done as a neutral, but I do a lot as a partisan on either side of civil cases. Even so, use of a neutral isn't something that uniquely benefits me. It's something any competent, ethical examiner can and should do. What I'm advocating won't hurt you; in fact, it'll likely add to your job satisfaction.

Here's what I posted:

"Your Honors:

I just read another opinion where the Court decided to let one side's computer expert examine an opposing party's computers. The Court seemed more concerned with who would pay for the exam than what its consequences might be.

I'm a lawyer and computer forensic examiner, and I make part of my living doing just the sort of examinations the court ordered. I've done a whole bunch of them. So, while part of me wants to encourage courts to order more forensic exams — and I can surely attest to their efficacy in resurrecting data thought gone and exposing case-making evidence — the angel at my ear requires me to softly whisper, "WHAT THE HECK WERE YOU THINKING, JUDGE?!?..."


Thursday, April 01, 2010


April 1st sees the announcement of two new organisations for digital forensics professionals. The International Federation of Forensic Examiners in Europe (IFFEE) and the Department of Justice Expert Examiners (DoJEE) group in the US both aim to provide practitioners with a variety of benefits ranging from professional liability insurance to full immunity against prosecution and covert extraction to a country of their choosing. These new organisations are also running a special promotion for the next 24 hours offering new members a complimentary packet of felt tip pens to improve the presentation of their reports - anyone wishing to take advantage of this great offer should email immediately.