Because computer forensics is a highly specialized discipline that requires training and experience to master. There are many legal standards that must be met and improper handling by untrained personnel may render any recovered evidence inadmissible. Often, unqualified examiners unwittingly destroy or alter electronic evidence. This reduces the probability of recovering relevant data and can have serious consequences during litigation.

The authenticity of computer evidence and the reliability of techniques used by the examiner may be subject to challenge.The forensic expert must be prepared to testify to the validity of programs and procedures utilized in the collection and examination of the computer evidence. Some factors to consider include:

• whether the employed technique or theory has been or can be tested
• whether the technique or theory has been subjected to peer review and publication
• whether, concerning a particular technique, there is a high known or potential rate of error
• whether standards controlling the techniques exist and are maintained
• whether the technique or theory is generally accepted by the relevant scientific community

If you are considering using an internal employee or an existing technology provider, be wary of the risks and consider the following questions. Does this individual possess the proper hardware and software to properly process electronic evidence? Can this individual qualify in court as an expert in computer forensic science? Can the individual defend his or her methodology? Does the state require licensing and, if so, is the individual or company licensed to collect and investigate digital evidence?

Often computer media is sent to a forensic expert for analysis after a company's computer personnel have already attempted to process it for evidence. In most cases, they have unintentionally altered key evidentiary items, changed file attributes, and greatly diminished the potential of the ensuing expert forensic examination. These second-hand examinations are far more time-consuming (and costly) because the qualified examiner must identify and separate the actions of the untrained inspector.