On the other hand, however, companies, and especially those that have not previously been involved in an investigation, often find it tricky to find a reputable consultant who is suitably qualified and experienced. The situation is not helped by the fact that, at the moment, the market is completely unregulated and anyone with a PC and a few forensics tools can call themselves an analyst with little fear of being taken to task.
"There are a phenomenal amount of cowboys in this sector, many of whom run their businesses from their garage and think they can do the job simply by sticking a hard disk in a metal filing cabinet and locking the door. The problem is people think it's easy, but for every one that's doing the job well, there are probably two or three that are appalling," explains Charles White, managing director at consultancy Information Risk Management.
White believes there is a clear requirement for a guild or professional body for IT forensics, equivalent to the Law Society for lawyers, which would oversee professional development and be authorised to take disciplinary action for incompetence or for bringing the profession into disrepute.
While the Council for the Registration of Forensics Practitioners (CRFP) set up a register for digital forensic specialists in November 2005 with the backing of the British Computer Society, according to Brian Collins, head of the information security department at Cranfield University, it is still in the process of working on an accreditation scheme.
As the man responsible for running the initiative, Collins is currently trying to get key practitioners around the table to work out what such a scheme should look like, but the aim is to have the programme in place within the next six to nine months, complete with disciplinary procedures.
In the meantime, however, the best course of action for organisations wanting to hire a specialist is to look up the handful of members currently on the CRFP register, to go to the Law Society to view their expert witness registers, use word-of-mouth recommendations or, as a last resort, undertake an online search that will at least provide names.
After having located a practitioner, the next stage is to check out whether they are suitable to carry out the task in hand. As Douglas points out: "Any old engineer with a few years of computer experience doesn't make for a good forensic analyst."
