Priorities for Any Competent Computer Forensics Examiner

¶ … priorities for any competent computer forensics examiner is the establishment of policies, processes and procedures to govern the structure of your forensics laboratory environment. According to the current Guide to Forensics and Investigations, it is of critical importance that you have first "defined policies, processes, and prescribed procedures before beginning any casework to ensure the integrity of an analysis and its results" (Nelson, Phillips, & Steuart, 2010). In the circumstances described, wherein you have been hired to perform digital investigations and forensics analysis for a company with no preexisting policies, processes or procedures in place, it is paramount that you immediately develop your own guidelines for the operation of your lab environment. The best way to begin would be through carefully researching the forensics lab management guidelines prescribed by the American Society of Crime Lab Directors, which include steps for identifying the duties of your various lab staff members, preplanning the budget and costs of your lab work, acquiring the certification and training necessary to operate a full-fledged forensics lab. When drafting a policies, processes and procedures document for a forensics lab, you should always keep in mind that an effective "lab manager creates and monitors lab policies for staff and provides a safe and secure workplace for staff and evidence" because "above all, the lab manager accounts for all activities the lab's staff conducts to complete its work" (Nelson, Phillips, & Steuart, 2010).

As a computer forensics examiner, the organizational policies of your employer may require you to investigate allegations of misconduct such as those made against Zane Wilkens by your spouse and fellow teachers. In a case as delicate as the one described, involving suspected child molestation and the storing of child pornography by a teacher, time is of the essence and the investigation planning process must be both thorough and expedient. Potential evidence must first be identified in preparation for any future criminal case, and prior to the acquisition of any data from Mr. Wilken's classroom computer certain critical pieces information will need to be obtained. For example, the operating system used by the school's faculty computer network will be needed to determine the forensic analysis tools required for the case, and per the Fourth Amendment's search and seizure provisions, probable cause will need to be firmly established before any warrants are sought and data is seized from the alleged crime scene.