Abstract The field of computer forensics is one of the newer disciplines in the area of forensic science. Like all of the others, it is going through a transition from an art practiced by individuals to a more standardized set of techniques for which “best practices” can be defined. Over the past few years, a number of documents have been published by governmental and nonprofit groups that may well serve as de facto statements of best practices. Certainly no computer forensic professional can fail to understand that these documents may well turn up as the basis for questions in cross-examination. In this paper, we review the state of the field and identify the key documents and publications—virtually all freely available over the Internet—that are forever changing the very nature of computer forensics. This paper is based on material presented by coauthors Brill and Pollitt at the 2005 National Training Conference of the International High-Technology Crime Investigation Association. It should be noted tha...

“All that you do when you freeze the specification on a large project is to guarantee that the system you install will be obsolete!” Can you imagine actually walking into the office of your most senior user and admitting that the new Whiz-Bang System, installed only last week after a 2-year development cycle, is obsolete? How are you going to explain that you just spent $12,000,000 to build a system that is 100% in sync with last year's needs? It's hard to imagine so painful a meeting, but when we freeze a spec, what we're doing is trying to serve a dynamic environment with a fixed product. No wonder so many systems face a plague of “minor enhancements” during the first months of their operating lives. “Sure,” you say, “it's nice to talk about flexibility, but how can we ever get anything done if we can't freeze the specs? That's what this session is all about. How can you maximize flexibility without bogging the project down completely? You'll learn both technical and managerial concepts that can help you to avoid pre-implementation obsolescence and improve user satisfaction.