Ball emphasizes that forensics is too important and complicated to be a part-time job for an IT person.
A record of published work;
Respect from peers;
Considerable court experience;
Report-writing skills; and
Extensive focus on the discipline.
Ball recommends looking for a computer-forensics expert that provides formal training and meaningful certification -- something with substantial components of practice examination, peer review and experience, like CCE (certified computer examiner) or EnCe (EnCase certified examiner). He also suggests that your expert have:
The electronic-discovery phenomenon is here to stay -- and the industry is still exploding.