What does a computer forensic examiner do?
The following is a quick overview and summary of what a certified computer forensic examiner (CFE) does. Before a CFE begins any work, they must verify that they have the proper administrative and/or legal authority to perform the examination. If one is contracted by a private individual, the scope of work must be within the law. It is the CFE’s responsibility to know the law pertaining to the circumstances. The CFE must have clear instructions on the permissible scope of the examination from an authorized company representative, or from an attorney. This is especially important as it must be assumed that these types of cases may end up in a court of law. All evidence must be processed and handled so it will be admissible in court. The acquisition, transfer, and all movements of the evidence media (i.e., hard drive) is documented with a chain of custody tracking sheet. The media is then write-protected and a sector-by-sector image is made. The exact image copy is verified using an al g
