The International Society of Forensic Computer Examiners  


image image image image image image image image image image

    ISFCE Certification Board

     

    Craig Ball 

    Craig Ball of Austin, Texas is a Board Certified trial lawyer, certified computer forensic examiner and electronic evidence expert. He's dedicated his career to teaching the bench and bar about forensic technology and trial tactics. After decades trying lawsuits, Craig limits his practice to service as a court-appointed special master and consultant in computer forensics and e-discovery. A prolific contributor to educational programs worldwide--having delivered over 700 presentations and papers--Craig’s articles on forensic technology and electronic discovery frequently appear in the national media. He writes a monthly award winning column on computer forensics and e-discovery for Law Technology News and Law.com called "Ball in your Court" and a monthly column on computer forensics for Forensic Focus.  Craig Ball has served as the Special Master or testifying expert on computer forensics and electronic discovery in some of the most challenging, front page cases in the U.S. He also currently serves as an Adjunct Professor at the University of Texas School of Law, teaching Electronic Discovery and Digital Evidence.


    Mr. Ball's education includes:


    Rice University (B.A., 1979, triple major)
    University of Texas (J.D., with honors, 1982)
    Oregon State University (Computer Forensics certification, 2003)
    EnCase Intermediate Reporting and Analysis Course (Guidance Software 2004)
    WinHex Forensics Certification Course (X-Ways Software Technology 2005)
    Certified Data Recovery Specialist (Forensic Strategy Services 2009)
    Numerous other classes on computer forensics and electronic discovery.


    Mr. Balls's selected professional activities include:

    Board Certified in Personal Injury Trial Law by the Texas Board of Legal Specialization
    Certified Computer Forensic Examiner, Oregon State University and NTI
    Certified Computer Examiner (CCE), International Society of Forensic Computer Examiners
    Member, Editorial Advisory Board, Law Technology News and Law.com (American Lawyer Media)
    Board Member, Georgetown University Law School Advanced E-Discovery Institute and E-Discovery Academy
    Member, Sedona Conference WG1 on Electronic Document Retention and Production
    Instructor in Computer Forensics and Electronic Discovery, United States Department of Justice
    Lecturer/Author on Electronic Discovery for Federal Judicial Center and Texas Office of the Attorney General
    Specialist Lecturer, Electronic Discovery, University of Texas School of Law faculty
    Instructor, HTCIA Annual 2010, Cybercrime Summit, 2006, 2007; SANS Instructor 2009, PFIC 2010, CEIC 2011
    Special Prosecutor, Texas Commission for Lawyer Discipline, 1995-96
    President, Houston Trial Lawyers Association (2000-01); President, Houston Trial Lawyers Foundation (2001-02)

     


    David C. Good

    Mr. Good has served the U.S Dept. of Treasury and the U.S. Dept. of Justice for the past 22 years. He has over 26 years experience in the management, design and implementation of mainframe systems, local area networks, and virtual private networks.


    Mr. Good’s experience includes:

    Electronic Data Systems, Camphill PA, Philadelphia PA, Seattle WA, Dallas TX, Washington D.C.
    1984 – 1988 Computer Operations, Network Operations, Network Solutions, Herndon VA
    1988 – 1989 Network Operations Automation Research Systems, Alexandria VA
    1989 – 1992 Local Area Network Installation and Management Washington D.C.
    1992 – Present Local Area Network Installation and Management, Enterprise Systems Architecture Program Management Computer Forensics

    He is currently serving as a Digital Investigator and Program Manager of the Digital Investigations and Cyber Crimes Branch for a National Law Enforcement Agency.

    This branch conducts seizure and analysis of electronic evidence.  He actively participates in search warrants, expert courtroom testimony, and instructs new Special Agents in the techniques of digital media extraction for computer forensics and mobile forensics .  He serves as director of the Digital Evidence Recovery Team (DERT) and International Digital Evidence Recovery Team (IDERT) and actively serves both deployment practices. He has completed the implementation of a secure virtual private network for all Digital Investigators to connect to a secure compartmentalized system.   Mr. Good serves on the Board of directors for the International Society of Forensic Computer Examiners.

    He has been cited as a computer forensic expert witness in US District Court, Charlotte, NC

    Mr. Good is an active member of the National Technical Investigators Association, The High Technology Crime Investigation Association, and the International Society of Forensic Computer Examiners.


    Mr. Good holds the following certifications:

    Novell Master Certified Network Engineer (MCNE)
    CCE
    Comptia A+
    Comptia Net+
    Comptia IT Project+

     


    Dan Mares

    Dan Mares founded Mares and Company, LLC in 1998 after retiring from a 27-year career as a federal law enforcement agent. He had responsibilities as an Investigator both in the field and in internal security. During that time he became interested in and obtained training in computer science. He began developing software programs designed to analyze large amounts of data retrieved from mainframe computer databases. Those programs were the precursors to the current Maresware data analysis software. Around 1986, he began working in the area of what is now termed 'computer forensics.' In the search for tools more suitable to the specific needs of computer forensic investigations, he then began developing software that was the precursor to Maresware computer forensic software.

    While serving as a federal agent, Dan assisted in the development of the Seized Computer Evidence Recovery Specialist (SCERS) course at the Federal Law Enforcement Training Center in Glynco, Georgia. He subsequently served as a SCERS instructor. He also assisted in the development and teaching of the Basic Data Recovery and Advanced Data Recovery classes at the National White Collar Crime Center.

    Mr. Mares is frequently an invited speaker and instructor in the field of computer forensics, fraud examination and other related areas. A few of the organizations he has appeared before include: International Association of Computer Investigative Specialists (IACIS); University of Texas, Austin.; Kennesaw State College; U.S. Secret Service; Southeast CyberCrime Institute; FBI Academy in Quantico, Va.; High Technology Crime Investigation Association(HTCIA); Institute of Police Technology and Management (IPTM); and Norwegian National Police Academy.

    Dan continues to provide forensic and technical computer assistance, conduct forensic investigations, and to provide training to individuals, corporations and government agencies. He has provided his services to numerous state and federal agencies, Big 5 accounting firms, law firms and courts, and private corporations of all sizes. He has developed and continually updates Basic and Advanced Computer Forensics Training Seminars offered through Mares and Company, LLC. In addition, he conducts training in the use of his own Maresware software, which is used by law enforcement, intelligence agencies, investigators, auditors, fraud examiners and other professionals worldwide.

    Mr. Maresis a highly effective expert witness and litigation consultant. His combined skills in forensic investigations and in forensic software development enhance his ability to testify effectively in court, particularly regarding the technical aspects of electronic evidence analysis and forensic methodology.

    Dan is professionally active in a number of organizations devoted to the advancement of the science and practice of computer forensics. Some of his memberships (and current or past office holdings) include:

    • HTCIA, High Technology Crime Investigation Association Atlanta chapter president, vice president, secretary
    • IISFA, International Information Systems Forensics Association Atlanta Chapter, Training director
    • IACIS, International Association of Computer Investigative Specialists IACIS.
    • ISSA, Information Systems Security Association.

    He was also involved during the early organizing of the group which has become NCTP (National CyberCrime Training Partnership). Dan has also devoted time and expertise to a number of NIST endeavors to create reference texts for computer forensic investigators and analysts.


    Mr. Mares holds certifications as a:

    Certified Information Forensics Investigator (CIFI) from ISFA (2003)
    Certified Computer Examiner (CCE)



    Mark McKinnon

    Mr. McKinnon’s Experience:

    Adjunct Faculty Member - Davenport University

    (Educational Institution; Higher Education industry)

    January 2009 — Present (1 year 7 months)

    Mr. McKinnon is currently one of the instructors teaching the Computer Forensics Course at the Lettinga campus in Grand Rapids


    Principal - RedWolf Computer Forensics

    (Computer & Network Security industry)

    January 2005 — Present (5 years 7 months)

    Performing Computer Forensics examinations and imaging. Create custom open source tools to aid in computer forensics examinations. Data retrieval/restoration - Deleted files, Formatted disks, CD-RW's, email's documents, images, etc.. Electronic Discovery.


    Database Administrator - Haworth, Inc

    (Privately Held; 5001-10,000 employees; Furniture industry)

    May 1990 — Present (20 years 3 months)

    Administor, Design, Perfromance Tunning, Backup, Recovery, Clonning of DB2, Oracle and SQL Server Databases. I have created automation scripts to handle daily monitoring and maintenance activities as well as alert me to potential problems. The databases range in size from 100+ meg to over 1/2 Terabyte.


    Mr. McKinnon’s Education:

    Grand Valley State University

    Master of Science , Software Engineering , 1991 — 1995

    Grand Valley State University

    BS , Computer Science and Information Systems , 1986 — 1991      

     


    Ryan Kubasiak

    Ryan R. Kubasiak is currently a Forensic Analyst and Instructor for BlackBag Technologies. Formerly, Mr. Kubasiak spent 14 ½ years as a sworn Member of the New York State Police with assignment as an Investigator to the Computer Crime Unit Forensic Laboratory. Prior to the NYSP, Mr. Kubasiak worked for the State University of New York at Buffalo as a Local Area Network administrator. He has been published as a lead author in Macintosh digital forensics and also is the Editor-In-Chief of the website "AppleExaminer.com".

    Investigator Kubasiak currently holds a degree or certification in the following notable areas:

          • Bachelor of Science in Computer Science

          • Certified Computer Examiner, GIAC Certified Forensic Analyst, Certified


    Electronic Evidence Collection Specialist

          • Apple Certified Technical Coordinator, Apple Certified Support Specialist

          • Access Data Certified Examiner

          • Encase Certified Examiner


    In addition, Investigator Kubasiak maintains associations internationally with the following well respected organizations:

          • High Tech Crime Investigators Association

          • High Tech Crime Consortium

          • Apple Developer Connection and Apple Seeding Program

     

     

    Sheryl Falk

    Sheryl Falk has spent the last decade  focusing on digital evidence and emerging technology issues. In addition to her extensive commercial litigation experience, Ms. Falk is certified in computer forensics and has in-depth technical knowledge and experience with data security and privacy matters. This background provides her clients with the specialized expertise and skills required to handle technology challenges, including data loss prevention, data breach response, and privacy counseling.

 

image

image