Skip navigation

Category Archives: Launch

Topics of Necessary Evil – Licensing

Mention to anyone in the Digital Forensics field that you are a DF examiner or investigator and you may quickly find yourself in a licensing & regulation discussion.

By interpretation, the state of South Carolina (via SC’s State Law Enforcement Division – SLED) has decreed that one must hold a Private Investigator’s license in order to fulfill the role of computer forensic examiner. 

This often cited law actually comes from the first answer of in a SLED FAQ and a nearly six year old SC Attorney General opinion. No existing state statute exists mandating that computer forensic examiners must be licensed Private Investigators.

In fact, the current SC Code of Laws says:

South Carolina Code of Laws
SECTION 40-18-20. Definitions

As used in this chapter, unless the context otherwise requires, the term:
(A) “Private investigation business” means engaging in business or accepting employment to obtain or furnish information with reference to the:
(1) identity, habits, conduct, business, occupation, honesty, integrity, credibility, knowledge, trustworthiness, efficiency, loyalty, activity, movement, whereabouts, affiliations, associations, transactions, acts, reputation, or character of a person;
(2) location, disposition, or recovery of lost or stolen property;
(3) cause or responsibility for fires, libels, losses, accidents, damage, or injury to persons or property; or
(4) securing of evidence to be used in a criminal or civil proceeding, or before a board, an administrative agency, an officer, or investigating committee.

And the then South Carolina Attorney General, Henry McMaster wrote on April 23, 2007, in response to the then SLED Chief of Staff, Chief Mark Keel:

Consistent with such, in the opinion of this [South Carolina Attorney General] office, the better reading of Sections 40-18-20, 40-18-30 and 40-18-70 support the conclusion that such provisions require that an individual or company selling their services in South Carolina as “computer forensics” experts secure licenses as private investigators. Such determination would be applicable to individuals who accept fees to examine and copy computer hard-drives to extract information to be reported to clients and to be presented in courts as evidence and/or testimony in civil and criminal actions. The duties performed by such individuals or companies would appear to meet the definition of “private investigation business.”

In recent years, there has been an effort underway in SC to formalize this discussion into perhaps more clearly worded language.  The most recent attempts occurred in the State Legislative Sessions of 2010-2011 and 2011-2012.  In 2012, S.580 made it to the Governor’s office where it was vetoed.

As I enter my seventh year of paying SLED an annual fee of $350 in order to perform the duties of a computer forensic examiner in the South Carolina I ask you — What do you think the South Carolina legislature should do in the upcoming term regarding Digital Forensic legislation?

What areas of DF are you interested in?

With literally dozens of areas of Digital Forensics (and Incident Response) that we would discuss, what would be key topics or questions you would want to ask someone who currently practices in the Digital Forensics field?

For me, I would like to hear how other people handle the following:

  • Report writing, perhaps sharing report templates;
  • Forms – contract language, chain of custody, evidence collection;
  • Investigative techniques; and finally…
  • Tool tricks.

My listed is in a ranked priority because I think forensic tools should come after good habits are developed. But that’s just me.

What would top your list of things to learn more about from local practicing forensicators?

Task One – Identify DF professionals within SC

One of the largest challenges with starting a new group is to identify potential interested parties in the digital forensics field that would like to participate.  In doing so, I strive to keep this project running on a very low budget with no membership dues required.  At this point I think participation would be the best membership fee that we could impose.

If you are interested, please leave a message – I will soon open up self registration so please take advantage of this and let’s see if we can get at least a couple of people together that might be interested in continuing the Digital Forensic discussion via a local meetup.

The Launch 0.2

South Carolina has many talented digital forensic practitioners. We also have dozens of colleges/universities in the state with students who are interested in this growing field.

So, a few of us have put our heads together and realized we should create a method to informally share information and hopefully have regular meet-ups to discuss digital forensics, e-discovery, incident response ideologies, network and share war stories.

We hope to share more information in the coming days but we are targeting a first meet-up in January 2013.