Choosing a Computer Forensic Expert

Before just choosing a Forensic Company, you may want to consider the following: 

• Who will the examiner be?
• What are their qualifications?
• Who trained them?
• What professional qualifications have they got relating to forensics?
• What tools will they use and are they appropriately trained in their use?
• How long have they been actually performing forensic examination/ when did they start their forensic career (NOT – when did the company start)?
• Has the examiner the experience in your hardware?
• Has the examiner the experience in your operating system?
• Has the examiner the experience in your software?
• How will the examiner preserve the original exhibits?
• How will the examiner prevent cross contamination of the evidence?
• How will the examiner ensure that the ‘chain of custody’ be maintained?
• Is there a confidentiality agreement in place?
• How long will it take to process your case?
• Will your case be one of many handled by ‘a member of staff’ or will you get personal attention from the examiner portrayed to you as carrying out the work?
• Is the examiner ‘security cleared’?
• Is the company accredited by any recognised forensic organisation or government agency?
• Does the company have ISO 9000 certification for its forensic services (look at the certificate and more especially the SCOPE of the certification)?
• Does the company comply with ISO 17799 (the code of practice for information security) or is it certified to BS 7799?
• Does the company comply with the current ACPO (Association of Chief Police Officers) Guidelines?