ISFCE Certification Board
Craig Ball of Austin, Texas is a Board Certified trial lawyer, certified computer forensic examiner and electronic evidence expert. He's dedicated his career to teaching the bench and bar about forensic technology and trial tactics. After decades trying lawsuits, Craig limits his practice to service as a court-appointed special master and consultant in computer forensics and e-discovery. A prolific contributor to educational programs worldwide--having delivered over 700 presentations and papers--Craig’s articles on forensic technology and electronic discovery frequently appear in the national media. He writes a monthly award winning column on computer forensics and e-discovery for Law Technology News and Law.com called "Ball in your Court" and a monthly column on computer forensics for Forensic Focus. Craig Ball has served as the Special Master or testifying expert on computer forensics and electronic discovery in some of the most challenging, front page cases in the U.S. He also currently serves as an Adjunct Professor at the University of Texas School of Law, teaching Electronic Discovery and Digital Evidence.
Mr. Ball's education includes:
Rice University (B.A., 1979, triple major)
University of Texas (J.D., with honors, 1982)
Oregon State University (Computer Forensics certification, 2003)
EnCase Intermediate Reporting and Analysis Course (Guidance Software 2004)
WinHex Forensics Certification Course (X-Ways Software Technology 2005)
Certified Data Recovery Specialist (Forensic Strategy Services 2009)
Numerous other classes on computer forensics and electronic discovery.
Mr. Balls's selected professional activities include:
Board Certified in Personal Injury Trial Law by the Texas Board of Legal Specialization
Certified Computer Forensic Examiner, Oregon State University and NTI
Certified Computer Examiner (CCE), International Society of Forensic Computer Examiners
Member, Editorial Advisory Board, Law Technology News and Law.com (American Lawyer Media)
Board Member, Georgetown University Law School Advanced E-Discovery Institute and E-Discovery Academy
Member, Sedona Conference WG1 on Electronic Document Retention and Production
Instructor in Computer Forensics and Electronic Discovery, United States Department of Justice
Lecturer/Author on Electronic Discovery for Federal Judicial Center and Texas Office of the Attorney General
Specialist Lecturer, Electronic Discovery, University of Texas School of Law faculty
Instructor, HTCIA Annual 2010, Cybercrime Summit, 2006, 2007; SANS Instructor 2009, PFIC 2010, CEIC 2011
Special Prosecutor, Texas Commission for Lawyer Discipline, 1995-96
President, Houston Trial Lawyers Association (2000-01); President, Houston Trial Lawyers Foundation (2001-02)
Mr. Good has served the U.S Dept. of Treasury and the U.S. Dept. of Justice for the past 22 years. He has over 26 years experience in the management, design and implementation of mainframe systems, local area networks, and virtual private networks.
Mr. Good’s experience includes:
Electronic Data Systems, Camphill PA, Philadelphia PA, Seattle WA, Dallas TX,
1984 – 1988 Computer Operations, Network Operations, Network Solutions, Herndon VA
1988 – 1989 Network Operations Automation Research Systems, Alexandria VA
1989 – 1992 Local Area Network
Installation and Management
1992 – Present Local Area Network Installation and Management,
Enterprise Systems Architecture Program Management Computer Forensics
He is currently serving as a Digital Investigator and Program Manager of the Digital Investigations and Cyber Crimes Branch for a National Law Enforcement Agency.
This branch conducts seizure and analysis of electronic evidence. He actively participates in search warrants, expert courtroom testimony, and instructs new Special Agents in the techniques of digital media extraction for computer forensics and mobile forensics . He serves as director of the Digital Evidence Recovery Team (DERT) and International Digital Evidence Recovery Team (IDERT) and actively serves both deployment practices. He has completed the implementation of a secure virtual private network for all Digital Investigators to connect to a secure compartmentalized system. Mr. Good serves on the Board of directors for the International Society of Forensic Computer Examiners.
He has been cited as a computer forensic expert witness in US District Court, Charlotte, NC
Mr. Good is an active member of the National Technical Investigators Association, The High Technology Crime Investigation Association, and the International Society of Forensic Computer Examiners.
Mr. Good holds the following certifications:
Novell Master Certified Network Engineer (MCNE)
Comptia IT Project+
Dan Mares founded Mares and Company, LLC in 1998 after retiring from a 27-year career as a federal law enforcement agent. He had responsibilities as an Investigator both in the field and in internal security. During that time he became interested in and obtained training in computer science. He began developing software programs designed to analyze large amounts of data retrieved from mainframe computer databases. Those programs were the precursors to the current Maresware data analysis software. Around 1986, he began working in the area of what is now termed 'computer forensics.' In the search for tools more suitable to the specific needs of computer forensic investigations, he then began developing software that was the precursor to Maresware computer forensic software.
While serving as a federal agent, Dan assisted in the development of the Seized Computer Evidence Recovery Specialist (SCERS) course at the Federal Law Enforcement Training Center in Glynco, Georgia. He subsequently served as a SCERS instructor. He also assisted in the development and teaching of the Basic Data Recovery and Advanced Data Recovery classes at the National White Collar Crime Center.
Mr. Mares is frequently an invited speaker and instructor in the field of computer forensics, fraud examination and other related areas. A few of the organizations he has appeared before include: International Association of Computer Investigative Specialists (IACIS); University of Texas, Austin.; Kennesaw State College; U.S. Secret Service; Southeast CyberCrime Institute; FBI Academy in Quantico, Va.; High Technology Crime Investigation Association(HTCIA); Institute of Police Technology and Management (IPTM); and Norwegian National Police Academy.
Dan continues to provide forensic and technical computer assistance, conduct forensic investigations, and to provide training to individuals, corporations and government agencies. He has provided his services to numerous state and federal agencies, Big 5 accounting firms, law firms and courts, and private corporations of all sizes. He has developed and continually updates Basic and Advanced Computer Forensics Training Seminars offered through Mares and Company, LLC. In addition, he conducts training in the use of his own Maresware software, which is used by law enforcement, intelligence agencies, investigators, auditors, fraud examiners and other professionals worldwide.
Mr. Maresis a highly effective expert witness and litigation consultant. His combined skills in forensic investigations and in forensic software development enhance his ability to testify effectively in court, particularly regarding the technical aspects of electronic evidence analysis and forensic methodology.
Dan is professionally active in a number of organizations devoted to the advancement of the science and practice of computer forensics. Some of his memberships (and current or past office holdings) include:
- HTCIA, High Technology Crime Investigation Association Atlanta chapter president, vice president, secretary
- IISFA, International Information Systems Forensics Association Atlanta Chapter, Training director
- IACIS, International Association of Computer Investigative Specialists IACIS.
- ISSA, Information Systems Security Association.
He was also involved during the early organizing of the group which has become NCTP (National CyberCrime Training Partnership). Dan has also devoted time and expertise to a number of NIST endeavors to create reference texts for computer forensic investigators and analysts.
Mr. Mares holds certifications as a:
Certified Information Forensics Investigator (CIFI) from ISFA (2003)
Certified Computer Examiner (CCE)
Mr. McKinnon’s Experience:
Adjunct Faculty Member - Davenport University
(Educational Institution; Higher Education industry)
January 2009 — Present (1 year 7 months)
Mr. McKinnon is currently one of the instructors teaching the Computer Forensics Course at the Lettinga campus in Grand Rapids
Principal - RedWolf Computer Forensics
(Computer & Network Security industry)
January 2005 — Present (5 years 7 months)
Performing Computer Forensics examinations and imaging. Create custom open source tools to aid in computer forensics examinations. Data retrieval/restoration - Deleted files, Formatted disks, CD-RW's, email's documents, images, etc.. Electronic Discovery.
Database Administrator - Haworth, Inc
(Privately Held; 5001-10,000 employees; Furniture industry)
May 1990 — Present (20 years 3 months)
Administor, Design, Perfromance Tunning, Backup, Recovery, Clonning of DB2, Oracle and SQL Server Databases. I have created automation scripts to handle daily monitoring and maintenance activities as well as alert me to potential problems. The databases range in size from 100+ meg to over 1/2 Terabyte.
Mr. McKinnon’s Education:
Grand Valley State University
Master of Science , Software Engineering , 1991 — 1995
Grand Valley State University
BS , Computer Science and Information Systems , 1986 — 1991
Sheryl Falk has spent the last decade focusing on digital evidence and emerging technology issues. In addition to her extensive commercial litigation experience, Ms. Falk is certified in computer forensics and has in-depth technical knowledge and experience with data security and privacy matters. This background provides her clients with the specialized expertise and skills required to handle technology challenges, including data loss prevention, data breach response, and privacy counseling.
Dustin Sachs is a Managing Consultant in the Digital Forensics and Incident Response practice at Navigant Consulting. He oversees and manages the computer forensics capabilities, including the forensics lab, in the Houston office. He assists with all phases of the forensic process from planning and collection to analysis and reporting so that attorneys, auditors, and investigators make informed decisions. He provides objective assessments of digital evidence in matters related to legal or ethical issues, data breach incidents, theft of valuable information, and other corporate investigations.
For more than nine years, Dustin has analyzed thousands of computer laptops, desktops, servers, and mobile devices in the support of civil and criminal litigation and internal investigative matters. He has received extensive training in computer forensics, evidence handling, and computer investigations.
Bachelor of Arts, Political Science, University of South Florida
Graduate Certificate, Computer Forensics, University of Central Florida
Certified Cyber Forensics Professional (CCFP)
Certified Computer Examiner (CCE)
Certified Fraud Examiner (CFE)
EnCase Certified Examiner (EnCE)
Cellebrite Certified Mobile Examiner (CCME)
Licensed Private Investigator in the states of Texas and Florida