An evolution in cell forensics

     Aside from relying on formal training, examiners can keep up-to-date by participating in forums, chatrooms and e-mail lists. Hanson participates in multiple e-mail lists and Punja visits several phone forensics forums including www.phone-forensics.com, which is based in the United Kingdom, a country he estimates to be five years ahead of North America in its cell seizure practices.

     "Training is the first step," says Richard Ayers, computer scientist at the National Institute of Standards and Technology. "Then it is practice, practice, practice with mock examinations and spending a lot of time with the tools you are going to be using and really getting to understand the nuances of the tools." He estimates that, dependent on the examiner's skill level, it will take three to six months on average to fully train a cell phone examiner.

     Proper training and time spent using the tools are critical in gleaning the most information from a cell seizure. "The operator has an impact on how much information you get," says Punja. "Somebody coming in to it brand new, being greeted with an array of tools, is facing a steep learning curve." After three years examining cell phones, Punja can quickly identify which tools will work best for each phone.

     "What you need is training on a multitude of devices," he continues. "Whether they are good or bad, you still need to understand that each product can do something, and it's knowing when to use which product at the right time."