On Wed, Aug 17, 2005 at 08:16:04AM -0500, Madison, Marc wrote: > Now, I agree that computer forensic work is currently unregulated and > misrepresented, but according to Mr. Christy, in the near future U.S. > Federal courts will not accept forensic work unless it was done in a > federally certified lab.
Certainly dc3.gov may harbor hopes along these lines (it would, for example, be a nice thing for DCITP, presumably), but this seems like an overstatement, to me. It could be taken to mean, for example, that sysadmins could no longer testify about their own log files or IDS traces. Plus, it's not clear what "federally certified" means, at this point. I can't imagine that federal courts would actually refuse to consider evidence unless it was discovered by federally authorized evidence- finders. > I see this as a move in the right direction > for the forensics industry, though I'm many so called experts will not. If a non-certified person presents a reasonable conclusion about a matter of computer forensics, what sense would it make to reject it out of hand? --Foofus. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
