QUALIFYING DIGITAL FORENSIC
PRACTITIONERS AS EXPERT
WITNESSES IN SOUTH AFRICAN
COURTS
Lex Informatica Conference
25th September 2014
 The role of forensic scientists in court continues
to grow and they can play a valuable role in
cases
FORENSIC
SCIENCE
EXPERTS
 As forensic scientists they are supposed to be
first an foremost scientists bound by prescribed
minimum scientific standards
 Digital forensics is an accepted forensic science
discipline and as such its practitioners need to
meet minimum scientific standards as well
 SWGDE
 ASTM
DIGITAL
FORENSIC
STANDARDS
 NIST
 ISO
 UNODC
 FEPAC
 FSS
 ENFSI
MINIMUM
ACCEPTABLE
ACADEMIC
STANDARDS
 A minimum of a Bachelors degree in Computer Science
or Computer Engineering, or a Bachelors degree in
Digital Forensic meeting either FEPAC or FSS
standards
 A Masters degree in Computer Science with a focus of
digital forensics, or a Masters degree in digital forensics
meeting either FEPAC or FSS standards, is a strong
recommendation
9%
ACADEMIC
QUALIFICATION
COMPLIANCE
IN SOUTH
AFRICA
Yes
No
91%
 Formal technical training in the field of digital forensics
MINIMUM
TECHNICAL
QUALIFICATION
 A general digital forensics certification which requires
regular proficiency testing and the maintenance of
continuing professional education
 Specific technical and tool certifications are
recommended
9%
TRAINING
COMPLIANCE
IN SOUTH
AFRICA
Yes
No
91%
 Exactly what tools did you use, and do you know what there
strengths and limitations are?
 Where did the tools locate the evidence and how do they parse
out the data?
ASKING THE
RIGHT
QUESTIONS
 What was the files system used on the media? Can you explain
how this file system is structured?
 Can you explain the different between sectors and clusters?
 Can you explain how email works?
 Can you explain how an Internet browser works?
 Can you explain TP/IP?
 Can you explain the mathematical processes involved in hashing?
OPEN
DISCUSSION
Jason Jordaan
CFCE, CFE, PMIITPSA, GCFE
THANK YOU
MSc, MTech, BComHons, BSc, BTech
Principal Forensic Scientist
jason@dfirlabs.com