Computer forensic examiners are from Mars, attorneys are from Venus
by Keith Chval - Co-founder of Protek - Wednesday, 27 March 2013.
The outcome of high stakes investigations and litigation can often depend on the evidence uncovered through computer forensic investigation. That fact highlights the critical nature of the forensic examiner-attorney relationship at the heart of forensic investigation.

Computer forensic investigations are critical to an enterpriseís response to a wide range of issues faced today, from a departing employeeís theft of proprietary information, to hostile workplace and employment claims, or responses to security breaches.

Ultimately, in all of these situations, the enterpriseís interests boil down to how, or whether, to pursue its rights or defend itself in a legal context. By necessity, a forensic examiner and an attorney will (or should) be working closely together in pursuit of the enterpriseís best interests.

After nearly fifteen years as a prosecutor and litigator, and now computer forensics consultant, Iíve seen and heard enough avoidable examiner-attorney relationship breakdowns to be in a position to offer a bit of counseling in identifying some of the most commonly occurring relationship killers, as well as a little practical advice for avoiding them.

In addition, I also reached out to some of the top flight litigators who we often work with and polled them on what was the first thing that came to mind regarding a frustration experienced when working with a computer forensics consultant. Their answers were illuminating, and many common frustrations were shared by several of the litigators.

Interestingly, many of the common frustrations have more to do with poor communication and a lack of care and nurturing of the examiner-attorney relationship, than with the technical competency of the examiner or her work.

Before there's even an engagement, embrace your purpose in life

Itís not about you! If you want to ensure not only a successful engagement or investigation but also a successful career, recognize that your purpose is to make whoever has brought you to the dance look good - nothing more, nothing less.

A courtroom supervising prosecutor in the county where I started my career used to tell his second and third chair prosecutors that their job was to make him look good. For those who succeeded at their ďjobs,Ē he made sure their careers flourished. Not so much for those who didnít get with the program.

Apply this mindset to every aspect of your forensic work, and I guarantee that you will have greater professional success than you ever imagined. Several specific examples of how this mindset is applied will follow.

In short, I implore you to approach every aspect of your work by asking yourself two simple questions- How can I make my attorney look good?, and its corollary, How can I make the examinerís life easier?

Getting it right from the start is critical

The very first stages of an investigation offer critical opportunities for forming a strong working relationship with counsel and establishing a strong foundation upon which a successful investigation can be built. Failure to take advantage of these opportunities will almost assuredly spell disaster and much heartache.

By understanding the essential facts of a case, as well as the legal objectives of the investigation or litigation, an examiner is able to become a strategic partner with counsel rather than just blindly digging out ones and zeroes in a vacuum.

Not only will this contribute to designing a focused, cost-effective examination plan, but the examiner will also understand how her work fits within counselís strategies, ensuring that critical evidence isnít overlooked and allowing for more persuasive work product tailored to counselís needs. (How can I make him look good?)


Critical bug found in Cisco ASA products, attackers are scanning for affected devices

Several Cisco ASA products - appliances, firewalls, switches, routers, and security modules - have been found sporting a flaw that can ultimately lead to remote code execution by attackers.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Fri, Feb 12th