After providing the original report, we may be asked to review or search for some new information. It is not unusual for this request to come several months after the initial work is completed, or even a year later. Keep files organized so that you can quickly start this process again. Obviously, having a chain of custody on the evidence ensures that the work is still admissible. Although the other pieces of evidence are not covered in this article, I would like to point out that the value of the information obtained from those other pieces of evidence will need to be weighed against the cost of acquiring it. The fact of the matter is that evidence might be found in a good number of places. If more review is needed, the facts of the case should be considered before choosing the evidence to be reviewed. Computer forensic professionals must maintain their edge with respect to technology, the law, and people, which produces an endless number of complex combinations. Most professionals' skills become flat when they stop using their forensic techniques. I would strongly encourage anyone who would like to work in the field of computer forensics to join professional associations such as HTCIA and others to help them maintain their edge. This series of articles was created to give you, the reader, a feel for the types of things encountered by computer forensics professionals. While these articles can get you going, a large amount of detail has been left out of this discussion. If I had to mention one trait that I think is common for computer forensic professionals, it would be the constant search to learn new things. If you want to have success in this field, you should develop this trait. Good luck and happy hunting!
展开▼
