In the public sector, examiners are
often involved with government agencies, such as municipal, county, state, or local
police departments, or federal law enforcement agencies, intelligence agencies,
and the military. These government
entities are responsible for investigating and prosecuting crimes. Investigations often pertain to crimes, such
as homicide, suicide, rape, burglary, molestation, or fraud. Due to the nature of these crimes, digital
forensic examiners may be required to assist investigators in unsafe and
potentially contaminated environments.
Some law enforcement agencies only
employ sworn examiners. While public-sector
agencies employ non-sworn examiners, many law enforcement agencies prefer sworn
officers with technology degrees or backgrounds. It is essential that the examiner in a
public-sector investigation understand the laws regarding computer-related
crimes, standard legal processes, guidelines on search and seizure, and how to
build a criminal case. Public-sector
agencies must preserve suspects’ Forth Amendment right restricting government
searches and seizures.
In a public-sector case, an
affidavit may be submitted by a police officer or the investigator if there is sufficient
cause to obtain a search warrant. A
judge receives the affidavit, which is a sworn statement of support of evidence
of a crime. The judge, then, approves
and signs the search warrant. Once the
warrant is ready to be executed, a Digital Evidence First Responder (DEFR) collects
the evidence defined in the warrant.
After the DEFR collects the evidence, the examiner can, then, analyze
the evidence, in order to determine if a crime has been committed.
The nature of private-sector
examinations and investigations are very different from those in the public
sector. Digital investigations in the
private sector usually concern company rules or policy violations. Not adhering to HIPAA rules is an example of
a policy violation. Private-sector cases
can involve such acts as computer asset, email, and Internet misuses and
abuses. An example of email abuse is the
transmission of offensive messages. This
kind of email abuse, which can lead to hostile work environments, can result in
civil lawsuits against a company, if it does not respond to such an abuse
appropriately. Internet misuse may take
the form of excessive web browsing.
Attorneys, corporations, and private
investigators can employ private-sector examiners. Attorneys may employ digital forensic
examiners to examine evidence pertaining to divorce cases, wrongful
termination, sexual harassment, and personal injury cases. The examiner’s evidence can be used in court
hearings or trials and when examiners are employed by attorneys, they can
expect to provide court testimony.
investigations usually begin as civil cases, they can develop into criminal
cases. Criminal cases could include
email harassment, falsification of data, embezzlement, sabotage, intellectual
property theft, misuse of investor funds, and corporate espionage. All industrial espionage cases are treated as