RE: Computer Forensics

From: Matias Bevilacqua <mbevilacqua(at)cybex.info>
Date: Tue May 06 2003 - 05:44:09 EDT

> Remember that "forensics" is defined through the use of forensics.
>
> Establishmentarians like to build big walls around the subject and ensure
> there is a high barrier to entry with requirements for
> certifications, formal
> education and training, and so forth... But the fact is, and always will
> remain, that forensics is expert rhetoric meant to convince others of a
> particular viewpoint.

Personally I don't believe in building this "high barrier", that's one of the reasons I believe and
Open Source approach is needed. On the other hand I agree with your assessment of forensics being essentially expert rhetoric in essence or nature but... and it's a big BUT. I feel that as any kind of forensic evolves, being it computer forensics or else, it starts maturing and becoming less and less rhetoric and more scientific. As all involved parties in a forensic process are educated and become more proficient with the technical nature of the process there is less space left for rhetoric. It's a good sign from my point of view that we're slowly focusing more on things such as methodology and procedures. After all it's all about facts, forensic examiners are there to uncover facts it's others job to extract conclusions from those facts and rhetoric should be one of the tools in their bags.

> Any forensic expert who believes with absolute certainty
> that their methods and procedures cannot be fooled is a danger to
> everyone in
> society because they are delusional.

Too true, that's why we need methods and procedures to be consented, agreed upon and subject to peer-review and updating by the experts in the community. It is the community backup which gives the added value to methodology and procedures, which in turn, add value to the community back again. It's a circle.

Regards,
Matías Bevilacqua Trabado
CYBEX

---

PGP-ID: 0x40A4869F
PGP Fingerprint: 2052 98A0 F0F0 2914 D7FA 4E7C 0488 7E8C 40A4 869F

---

CYBEX
Grupo Intelligence Bureau
Rambla de Catalunya, 32 4º-2ª
08007 Barcelona
Tel. 93 215 53 23
Fax. 93 215 50 72
http://www.cybex.info

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Tue May 6 09:01:41 2003