Computer Forensics Travel
Most examiners spend the majority of their day working in an office or lab environment. Today suspects can hide evidence using methods like encryption and steganography, and consequently, examinations are becoming more challenging and thus more time-consuming. Computer forensics travel might be required in some cases.
Local Travel for Evidence Collection
While computer forensics professionals on both sides of the field typically work normal business hours. However, because of their specific expertise, it is not uncommon for forensic examiners practicing in either the public or private sector to be pulled from their desks, or their beds for that matter, to assist in evidence collection. This can involve the execution of a search warrant at a suspect’s home for computer equipment or a stealth extraction of data from a corporate employee’s workstation after business hours.
Out-of-State Travel for Computer Forensic Conferences and Training
In addition to the limited local travel to confiscate digital media, local and state law enforcement forensic investigators often travel several times a year to other states to attend conferences and training in hi-tech investigations and computer forensics. Beyond that, it is not often that state and local law enforcement examiners travel outside the state. It is somewhat different for federal agency forensic examiners, however. Federal level examiners, in addition to travel to attend training and conferences, often travel to other parts of the country, and even the world, because of their positions. This is due, in large part, to the fact that federal level examiners have nationwide, and sometimes worldwide jurisdiction to investigate.
Travel on the Private Side of Computer Forensics
Private side examiners typically travel more frequently. In fact, forensic examiners on the private side can travel up to 70% of the time. The amount of travel typically depends upon the size of the company, the client in the particular case, and the location of evidence. The chain of custody in court cases is extremely important; so much so that it is often imperative for a computer forensic investigator to fly to a given location to recover, or just pick up, a hard drive. It is also not uncommon for larger forensic firms to have a presence in many states. California, Texas, New York, Illinois, and Washington D.C. are states where forensic practices thrive. It is commonly the practice for larger firms to staff these areas heavily while maintaining a smaller staff in other offices. If the less-staffed office needs assistance, other offices are called upon to send their examiners for a particular case. With the large accounting firms in particular, such resource sharing can include international travel.
The same may be true for corporations maintaining their own information security and computer forensic staff. Often they are called upon to fly to other locations on short notice to perform “black bag” operations, stealthily examining employees’ workstations for evidence of corporate misconduct.