-: Forensic training and certification.
So, in addition to having training and certification
in the cybersecurity world, if you're gonna
be connecting forensics, you should probably
get your training and certification in that world as well.
Full-time forensic personnel should be
properly trained and certified for the position
because if not, the evidence they collect
could be deemed not admissible in court and thrown out.
And so your perpetrator of the crime
can get off because you're not properly trained.
Forensic experts and their credentials
can be called into question by the defense attorney,
and so for instance, when I was dealing
with some forensic investigations early on,
I actually got questioned by the attorneys
to verify whether or not I knew enough
to be considered a forensic expert.
And based on those questionings, they could determine
whether or not the evidence I collect
was valid in court or not.
Now, how do you prove that you have
a proper training and certification?
Well, one way would be to have a degree in that subject.
But that's not the case for everyone and
a lot of the forensic techniques
aren't based on your degree because your degree,
there's not really a forensic, cyber degree.
There's cybersecurity degrees,
there's information assurance degrees,
there's computer programming degrees,
and there's IT degrees, but there's
not necessarily a forensics degree.
So how do we show that we are
properly trained and certified?
Well, there's numerous industry certifications,
and if you hold one of these, it makes it much harder
for the defense attorney to say,
"You're not qualified to do your job."
So there's ones like the Certified Computer Examiner,
the Certified Forensic Computer Examiner,
the Computer Hacking Forensic Investigator,
the GCIA Certified Forensic Analyst,
or Certified Forensic Examiner,
AccessData who makes the FTK software
has their certification called the ACE,
the AccessData Certified Examiner.
If you're using EnCase as your certification,
as your forensic product, you should be
EnCase Certified Forensic Examiner.
And if you're working for the Department of Defense,
they have their own set of certifications,
listed here on the bottom which is
the Digital Media Collector and
the Digital Forensic Examiner.
So if you're working in a federal capacity,
those are some of the courses you might go through as well.
So, do you need this if you're working
in an organization doing forensics
internally to your organization only?
Well, no, but if you are gonna be having to go into court
and defend your evidence you've collected,
then you might wanna have some of
these certifications under your belt,
specifically for the ones that you're using
for your particular product, whether
that's EnCase or FTK, because that is
the two biggest ones in the industry.