This expert will consult with attorneys / clients that are located in: AK (Alaska), AL (Alabama), AR (Arkansas), AZ (Arizona), CA (California), CO (Colorado), CT (Connecticut), DC (District of Columbia), DE (Delaware), FL (Florida), GA (Georgia), HI (Hawaii), IA (Iowa), ID (Idaho), IL (Illinois), IN (Indiana), KS (Kansas), KY (Kentucky), LA (Louisiana), MA (Massachusetts), MD (Maryland), ME (Maine), MI (Michigan), MN (Minnesota), MO (Missouri), MS (Mississippi), MT (Montana), NC (North Carolina), ND (North Dakota), NE (Nebraska), NH (New Hampshire), NJ (New Jersey), NM (New Mexico), NV (Nevada), NY (New York), OH (Ohio), OK (Oklahoma), OR (Oregon), PA (Pennsylvania), PR (Puerto Rico), RI (Rhode Island), SC (South Carolina), SD (South Dakota), TN (Tennessee), TX (Texas), UT (Utah), VA (Virginia), VT (Vermont), WA (Washington), WI (Wisconsin), WV (West Virginia), & WY (Wyoming).

Here are some examples: a labor relations expert questions wage data obtained from an electronic time clock; an accounting expert deciphers financial data retrieved from a damaged computer disk; or an engineering expert analyzes configuration data extracted from an industrial automation system. As each of the cases evolve, electronic data will be obtained and combined to form conclusions that may be later challenged as "bad data." The subject-matter experts may be well versed in labor or finance or engineering, but what are their skills in verifying computer data? Any attorney engaging an expert should address this concern long before the opposing attorney addresses it in deposition.

One traditional approach to verifying data sources has been incorporation of a computer forensics expert to augment the subject-specific expert. This after-the-fact approach presents at least two problems: 1) engagement of the forensics expert often comes too late to salvage verifiable data, and 2) forensics experts typically have a narrow focus that limits their value in the non-computer matter under investigation. A more efficient solution in the era of computerization is to engage a subject matter expert who also has adequate credentials in computer forensics.

The engineering example listed above is typical of my own practice area. Similar situations involving automated equipment failures encouraged me to seek and obtain formal credentials in computer forensics to augment my engineering pedigree. I now consider "chain of evidence" procedures before addressing the case's technical aspects that may be totally unrelated to the attached computers. Attorneys should realize that the seemingly unimportant computers and their vast resource of data may eventually become more important than the technical findings they produced. Computer forensics is therefore a useful tool for an expert to carry in their toolbox.

Although I have engineering licenses issued by several states, there are no equivalent certifications in computer forensics. This statutory void is currently being filled by academic organizations who set their own computer forensics standards, and also provide software and training to meet them. These programs generally target computer technicians in law enforcement and government, but qualified applicants from other fields can qualify if they meet the security requirements and demonstrate an adequate technical background. Engineers such as myself with extensive low-level computer experience are welcome candidates for forensics training.

After researching available programs, I chose a leading computer forensics program at a major university due to its diverse mix of technical and procedural content. I then invested the necessary time and expense to attend the program, study and pass the examinations, and procure the specialized hardware and software required to implement what I had learned. As a properly trained computer forensics expert I do not simply copy disks and concentrate only on their contents. Instead, I apply proper computer forensic procedures to ensure that the data I obtain, and the results I produce, can withstand rigorous scrutiny long after the chance to "do it over" is gone.

Bottom line: don't overlook computer forensics in any matter involving electronic data. Either engage a computer forensics expert on Day One, or even better, engage a subject-specific expert who can also apply proper forensics procedures as part of their overall service.