The Forensic Investigator and Ethics

What it is

A computer forensic investigator is a trained person who identifies, collects, preserves, analyzes and presents digital evidence in a way that is legally defensible. The role combines technical skill, legal awareness and personal integrity.

An organization needs one because ordinary IT staff may destroy evidence by accident, and because a court accepts evidence only if it was handled correctly and explained by a competent person.

How it works

Need for a forensic investigator

Reasons a trained investigator is needed:

• Digital evidence is fragile and easy to change by simply looking at it.
• Evidence must be gathered in a way that survives court challenge.
• Specialized tools and methods are needed to find deleted, hidden and encrypted data.
• A neutral expert can give an objective account of the facts.

Roles and responsibilities

What makes a good investigator

A good investigator has:

• Strong knowledge of operating systems, file systems, networks and forensic tools.
• Knowledge of the law and rules of evidence.
• Attention to detail and patient, methodical habits.
• Honest, impartial thinking that follows the evidence, not a theory.
• Clear written and spoken communication.
• Willingness to keep learning, because technology and tools change.
• Discretion with confidential information.

Code of ethics

Professional codes (such as those of EC-Council and other forensic bodies) share common principles:

• Act with honesty and integrity, and remain impartial.
• Do not exceed the authority granted by the court, warrant, client or consent.
• Keep information confidential, and do not reveal it except as the law requires.
• Do not alter, plant or destroy evidence.
• Offer opinions only within your competence, and state the limits of the findings.
• Do not accept a case where there is a conflict of interest.
• Do not let payment or the client's wishes decide the conclusions.
• Disclose the methods used so others can repeat the work.

Managing clients or employers during investigations

The client or employer is often anxious and may ask for quick answers or a particular result. The investigator should:

1. Agree the scope, authority and fees in writing before starting.
2. Explain what can and cannot be found, and the likely timeline.
3. Limit who learns about the case to those who need to know.
4. Keep the client informed of progress, but never share conclusions that are not supported.
5. Refuse requests to hide facts, stretch the scope or alter evidence.
6. Hand back or secure evidence according to the agreement and the law.

Accessing computer forensics resources

An investigator uses several kinds of resources: hardware (write blockers, imaging devices, forensic workstations), software (imaging and analysis suites, hash tools, memory tools), reference databases (known file hash sets such as the NIST National Software Reference Library), standards and guides (NIST, SWGDE, ISO), and professional networks, laboratories and training. Tools should be validated and kept current, and a laboratory should keep its tools and procedures documented.

Other factors that influence forensic investigations

A worked example

A company director asks an investigator to examine a staff laptop and to leave out anything that points to the director's own use of it.

The investigator cannot agree. The scope may be limited only on a legitimate basis, and findings must not be shaped by the client. The investigator documents the request, continues under the agreed authority and reports all relevant facts.

How the exam asks about this

• "A client asks an investigator to leave unfavorable evidence out of a report. What should the investigator do?" → Refuse, because honesty and impartiality come first.
• "What must be documented at every handover of evidence?" → The chain of custody.
• "Who may an investigator examine a system for?" → Only those who have given legal authority or consent.