Author: Anonymous

If reciprocity exists between two states for computer forensic examiners under private investigation registration, the examiner may freely take work originating in the other state.

Analyst’s commentary in a report is usually acceptable without marking it as such because of the analyst’s expert witness status.

Cross-correlation is relatively unimportant in Intelligence forensics cases.

The most important qualification to performing a competent, thorough computer forensic examination is:

To testify successfully in a court of law as to one’s skill in computer forensics, an advanced degree is customary and necessary.

Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations by the Computer Crime and Intellectual Property Section, Criminal Division, of the US Department of Justice provides:

In a typical commercial computer intrusion report, it is completely acceptable and normal to include a recommendations section as to how the victim organization can address the vulnerabilities that allowed the compromise to take place.

Standard Operating Procedures rarely require tool vetting for function or accuracy before being used, as it is usually assumed that all professional forensics tools are appropriately tested and functional.

The definition of “Intelligence,” in the context of this course and computer forensic examination, includes:

The confidentiality requirement for attorney/client privilege has been gradually _________ through judicial decisions.