In today’s world of social media, investigators
are taking on a new role; they are becoming
a form of eyewitness. As the eyewitness, an
investigator observes evidence that might not
be visible to any other available investigator.
The investigator is wise to create a record of
what he or she sees at any particular point in
time, including print outs of screenshots.
From: Social Media and the Changing Role of
These divergent paths may eventually lead to:
Investigators by Benjamin Wright
Education in Digital
Not too long ago there were few public sector
agencies fully equipped and staffed to perform
analysis on digital media. Many employed
examiners whose prior experience consisted of
being a sworn officer or investigator. Internal
and external training programs were limit-
ed and not formalized. Likewise there were
virtually no undergraduate or graduate pro-
grams to assist in preparing an individual for a
career in digital forensics. However, over the
past ten years or so, the landscape has dramat-
ically changed with the expansion of digital
forensics services in both the public and private
sectors. External training programs and techni-
cal certifications are now commonplace as are
undergraduate and graduate degree programs in
digital forensics. The diversity and complexity
of currently available forensic software and
hardware tools far exceeds what was available
just several years ago. A question often asked
is, “What education and training is necessary
to work in digital forensics?” There is not one
easy, simple answer to this question. First of all,
an individual has to make a choice of career
pathways, namely do they wish to work in the
public sector or in the private sector.
•;Different types of employers.
•;Working with different types of employees.
•;Needing different qualifications.
•;Working on distinct types of cases.
•;Having different job expectations.
•;Differences in salaries and benefit
From: Starting A Career in Digital Forensics by
John J. Barbara
Challenges in Smartphone
Forensics: Passwords and
Not only does data storage vary from device to
device and OS to OS, but devices may also be
passcode-protected and/or encrypted.
iPhone passcodes fall into two categories:
simple and complex. A mobile data extraction
tool should be able to reveal a simple passcode
automatically for most devices. Following the
passcode extraction process, it will be possi-
ble to extract and decrypt all data including
A complex iPhone passcode, however, takes
more effort. The investigator needs to know,
and manually insert, this type of passcode in
order to extract and decrypt all data. This may
take interviewing the subject or the subject’s
close contacts. If the investigator cannot figure
out what the passcode is, no mobile forensic
tool exists that can bypass it. Some data can
be extracted and decrypted, but not protected
From: 6 Persistent Challenges with Smartphone
Forensics by Ronen Engler and Christa M.