Re: Re: pnp worm unknown variant - post infectionactions

[foofus () foofus net]

On Wed, Aug 17, 2005 at 08:16:04AM -0500, Madison, Marc wrote:
> Now,  I agree that computer forensic work is currently unregulated and
> misrepresented, but according to Mr. Christy, in the near future U.S.
> Federal courts will not accept forensic work unless it was done in a
> federally certified lab.  

Certainly dc3.gov may harbor hopes along these lines (it would, for 
example, be a nice thing for DCITP, presumably), but this seems like
an overstatement, to me.  It could be taken to mean, for example, that
sysadmins could no longer testify about their own log files or IDS
traces.  Plus, it's not clear what "federally certified" means, at this 
point.

I can't imagine that federal courts would actually refuse to consider 
evidence unless it was discovered by federally authorized evidence-
finders.

> I see this as a move in the right direction
> for the forensics industry, though I'm many so called experts will not.

If a non-certified person presents a reasonable conclusion about a 
matter of computer forensics, what sense would it make to reject it
out of hand?

--Foofus.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/